TODO.md: remove the work log, keep only open work (closes #167)

Drop the Completed Steps log and the finished "commit this TODO.md"
item. Git keeps the history. The Workflow section now says to delete
the finished Next Step, as the standard Workflow block does.

Model: opus-5-5

.gitattributes

@@ -1,2 +1,7 @@
+# Every PR adds an entry at the top of TODO.md's Completed Steps; union keeps
+# both sides instead of conflicting. Git never reports a conflict here: read
+# the merged entries after every merge or rebase.
+TODO.md merge=union
+
 # yarn's release file is one opaque file in diffs and merges.
 .yarn/releases/** binary

script/install-precommit

@@ -8,8 +8,8 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
     cd "$ROOT"
     hook=".git/hooks/pre-commit"
-    printf '#!/bin/sh\nset -e\nscript/precommit\n' > "$hook"
-    chmod +x "$hook"
+    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
+    chmod +x .git/hooks/pre-commit
     echo "pre-commit hook installed: runs script/precommit"
 }
 

script/lint

@@ -1,11 +1,11 @@
 #!/bin/sh
 # script/lint: run the linter. Linting is a phase of the Dockerfile and
-# this builds that phase; the linter is never installed or run on
+# this builds that phase alone; the linter is never installed or run on
 # a developer host, where a shared result cache and a host-global lock
 # make its answer untrustworthy.
 #
-# --target builds the lint phase and the stages it depends on, nothing
-# else. A new CACHEBUST value reruns every RUN step after
+# The phase is not the last stage in the file, so it is built only when
+# --target names it. A new CACHEBUST value reruns every RUN step after
 # the ARG CACHEBUST line, since a cached lint layer is a lint that did
 # not run; unlike --no-cache, it keeps the layers above that line and
 # the cache mounts. This relies on every stage of the Dockerfile

script/test

@@ -1,8 +1,8 @@
 #!/bin/sh
 # script/test: run the test suite. Testing is a phase of the Dockerfile
-# and this builds that phase, on the same terms as script/lint:
-# --target so that only the test phase and the stages it depends on are
-# built, and a new CACHEBUST value because a cached test layer is a test
+# and this builds that phase alone, on the same terms as script/lint:
+# --target because a phase that is not the last stage is built only when
+# named, and a new CACHEBUST value because a cached test layer is a test
 # that did not run; unlike --no-cache, it keeps the layers above the ARG
 # CACHEBUST line and the cache mounts. This relies on every stage of the
 # Dockerfile declaring ARG CACHEBUST before every step that lints, tests