Pin host Go tools by commit hash with go install (closes #37)

Writes sneak's 2026-09-09 ruling into the script/bootstrap bullet of
REPO_POLICIES.md: a Go tool a repo needs on the host is installed with
go install pinned to a commit hash, never tracked as a go.mod tool
dependency or through a tools.go file. golangci-lint is unchanged; it
stays pinned only by its image digest.

Model: opus-5-5

TODO.md

@@ -25,9 +25,6 @@ fmt-check, and commit.
   is pinned (issue 37): installed with `go install` pinned to a commit hash,
   never tracked as a `go.mod` tool dependency or through a `tools.go` file.
   golangci-lint is unaffected, since no repo installs it on the host.
-- 2026-10-04: `package.json` now has `"license": "MIT"`, matching `LICENSE`, so
-  yarn no longer prints "No license field" when `script/bootstrap` runs it
-  inside the Docker phases (issue 76). That was the only yarn warning there.
 - 2026-10-04: `REPO_POLICIES.md` now states that guidance for coding agents
   lives in one `AGENTS.md` at the repository root, never under a file or
   directory named after one agent tool and never in separate memory files (issue

package.json

@@ -1,5 +1,4 @@
 {
-  "license": "MIT",
   "devDependencies": {
     "prettier": "3.8.1"
   }

prompts/REPO_POLICIES.md

@@ -496,7 +496,7 @@ style conventions are in separate documents:
     Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
 
     A Go tool a repo needs on the host is installed with `go install` pinned to
-    a commit hash (`go install <package>@<commit hash>`). It is never tracked as
+    a commit hash (`go install <module>@<commit hash>`). It is never tracked as
     a `go.mod` tool dependency or through a `tools.go` file, either of which
     pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.