Add policy: always use Makefile targets over direct tool invocation

REPO_POLICIES.md

@@ -36,6 +36,10 @@ docker` (builds docker image).
 
 - `main` must always pass `make check`, no exceptions.
 
+- Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
+  instead of invoking the underlying tools directly. The Makefile is the
+  single source of truth for how these operations are run.
+
 - Do all changes on a feature branch. You can do whatever you want on a
   feature branch.