script/install: stop on a repo's own script of the same name

script/install replaced any tracked script/install or
script/update-policy in the target, including a repo's own unrelated
script. It now stops when such a file has a line the canonical file
has never held. An older shared copy is still replaced.

The padded file in the self-replacement test is now an earlier
canonical version, so the new stop does not catch it.

Model: opus-5-5

prompts/EXISTING_REPO_CHECKLIST.md

@@ -221,7 +221,8 @@ with your task.
       anything, naming the file and the entry. It stops the same way on a line
       in `.golangci.yml` that the canonical file has never held, apart from
       comments and the repo's entries in the `deny` list of the `test-support`
-      rule.
+      rule. It also stops on a repo's own `script/install` or
+      `script/update-policy`.
 - [ ] README has an **Entrypoints** section documenting the `script/`
       entrypoints and linking the standard
 - [ ] `script/lint` and `script/test` each run