Fold the August fleet findings into the policies, or drop them (closes #62)

Two findings from 2026-08-09 were rules a repository must follow that
`prompts/REPO_POLICIES.md` did not yet state, and are now added where a
reader would look: a new or changed check is proven by planting a defect
it must catch; and a change to a separate workflow limited to `main` by
a `branches` list is first run from the feature branch, added to that
list and removed again before merging. The issue records why every
other finding was dropped. The warning against `golangci-lint config
verify` is dropped because sneak ruled on
#40 (2026-08-10) that there is
no config check step and the config is assumed valid; a vendored
`.golangci.yml` stays byte-identical to the canonical copy.

Model: opus-5-5

TODO.md

@@ -27,9 +27,11 @@ fmt-check, and commit.
   workflow limited to `main` is first run from the feature branch, added to that
   workflow's `branches` list and removed again before merging. The other
   findings were already stated, replaced by `--no-cache`, about git worktrees,
-  about how agents work together, or no longer true (the pinned golangci-lint
-  checks `config verify` against a schema built into it and fetches nothing);
-  the issue gives each reason.
+  or about how agents work together. The warning against
+  `golangci-lint config verify` is dropped because sneak ruled on
+  https://git.eeqj.de/sneak/prompts/issues/40 (2026-08-10) that there is no
+  config check step and the config is assumed valid; a vendored `.golangci.yml`
+  stays byte-identical to the canonical copy. The issue gives each reason.
 - 2026-10-04: The note under the canonical Go `Dockerfile` example in
   `REPO_POLICIES.md` now installs lint-phase system libraries with `apt-get`
   under their Debian package names (issue 83). The `golangci/golangci-lint`