Allow packages from the base image's own distribution unpinned (closes #72)

A package from the pinned base image's own distribution package index
now needs no version and no hash, on sneak's answer at
#72 (comment). The
distribution is trusted, and everything else stays pinned by hash. A
package source that a Dockerfile adds itself does not get the exception.

The first rule of REPO_POLICIES.md and both checklists say so, and the
canonical Go Dockerfile's apk add line has a comment saying why it is
allowed.

Model: opus-5-5

TODO.md

@@ -21,13 +21,12 @@ fmt-check, and commit.
 
 # Completed Steps
 
-- 2026-11-03: A package from the distribution's own package index now needs no
-  version and no hash, and pulling that index is allowed
+- 2026-11-03: A package from the pinned base image's own distribution package
+  index now needs no version and no hash
   (https://git.eeqj.de/sneak/prompts/issues/72), on sneak's answer at
   https://git.eeqj.de/sneak/prompts/issues/72#issuecomment-165196. The
-  distribution is the pinned base image's in a `Dockerfile` and the host's on a
-  host. It is trusted, and everything else stays pinned by hash. A package
-  source that a `Dockerfile` adds itself does not get the exception. The pinning
+  distribution is trusted, and everything else stays pinned by hash. A package
+  source that a `Dockerfile` adds itself does not get the exception. The first
   rule of `REPO_POLICIES.md` and both checklists say so, and the canonical Go
   `Dockerfile`'s `apk add` line has a comment saying why it is allowed.
 - 2026-11-03: A first test run that timed out now gets no verbose rerun

prompts/EXISTING_REPO_CHECKLIST.md

@@ -217,11 +217,9 @@ with your task.
 - [ ] No secrets in the repo (`.env`, keys, credentials)
 - [ ] No mutable references in Dockerfiles or scripts (tags, `@latest`) — all
       pinned by cryptographic hash with version/date comment. The one exception
-      is a package from the distribution's own package index, which needs no
-      version and no hash. Pulling that index is also allowed. In a
-      `Dockerfile`, the distribution is the pinned base image's. On a host, it
-      is the host's. A package source that a `Dockerfile` adds itself does not
-      get this exception
+      is a package from the pinned base image's own distribution package index,
+      which needs no version and no hash. A package source that a `Dockerfile`
+      adds itself does not get this exception
 - [ ] Using `yarn`, not `npm` (JS projects)
 
 # Directory Structure

prompts/NEW_REPO_CHECKLIST.md

@@ -244,10 +244,9 @@ are thin shims calling them. Model scripts:
 - [ ] No secrets in repo, and none in the build context: enumerate a probe image
       rather than reading `.dockerignore`
 - [ ] No mutable image/package references. The one exception is a package from
-      the distribution's own package index, which needs no version and no hash.
-      Pulling that index is also allowed. In a `Dockerfile`, the distribution is
-      the pinned base image's. On a host, it is the host's. A package source
-      that a `Dockerfile` adds itself does not get this exception
+      the pinned base image's own distribution package index, which needs no
+      version and no hash. A package source that a `Dockerfile` adds itself does
+      not get this exception
 - [ ] No unnecessary files in repo root
 - [ ] All dates written as YYYY-MM-DD
 

prompts/REPO_POLICIES.md

@@ -33,13 +33,11 @@ style conventions are in separate documents:
   is the single most important rule in this document. Double-check every
   external reference in every file before committing.
 
-    There is one exception: a package from the distribution's own package index
-    needs no version and no hash. Pulling that index is also allowed. The
-    distribution is trusted. In a `Dockerfile`, it is the pinned base image's
-    distribution. On a host, it is the host's. These commands are examples:
-    - `apt-get update`
+    There is one exception: the package index of the pinned base image's own
+    distribution. The distribution is trusted, so these commands may use that
+    index with no version and no hash:
+    - `apt-get update`, which pulls the index
     - `apt-get install`
-    - `apk update`
     - `apk add`
 
     These are not trusted, so everything from them stays pinned by hash: