Fold the August fleet findings into the policies, or drop them (closes #62)

Two findings from 2026-08-09 were rules a repository must follow that
`prompts/REPO_POLICIES.md` did not yet state, and are now added where a
reader would look: a new or changed check is proven by planting a defect
it must catch; and a change to a separate workflow limited to `main` by
a `branches` list is first run from the feature branch, added to that
list and removed again before merging. The issue records why every
other finding was dropped. The warning against `golangci-lint config
verify` is dropped because sneak ruled on
#40 (2026-08-10) that there is
no config check step and the config is assumed valid; a vendored
`.golangci.yml` stays byte-identical to the canonical copy.

Model: opus-5-5

TODO.md

@@ -21,6 +21,17 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-04: Went through the fleet findings recorded on 2026-08-09 (issue 62)
+  and added the two rules `REPO_POLICIES.md` did not yet state: a new or changed
+  check is proven by planting a defect it must catch; and a change to a separate
+  workflow limited to `main` is first run from the feature branch, added to that
+  workflow's `branches` list and removed again before merging. The other
+  findings were already stated, replaced by `--no-cache`, about git worktrees,
+  or about how agents work together. The warning against
+  `golangci-lint config verify` is dropped because sneak ruled on
+  https://git.eeqj.de/sneak/prompts/issues/40 (2026-08-10) that there is no
+  config check step and the config is assumed valid; a vendored `.golangci.yml`
+  stays byte-identical to the canonical copy. The issue gives each reason.
 - 2026-10-04: The note under the canonical Go `Dockerfile` example in
   `REPO_POLICIES.md` now installs lint-phase system libraries with `apt-get`
   under their Debian package names (issue 83). The `golangci/golangci-lint`