The pinning rule now opens with its scope: what we download and install
ourselves in scripts and Dockerfiles. Distribution packages follow right
after as outside the rule, with updating and upgrading allowed. Both
checklists say the same.
Model: opus-5-5
sneak