Writes sneak's 2026-09-09 ruling into the script/bootstrap bullet of
REPO_POLICIES.md: a Go tool a repo needs on the host is installed with
go install pinned to a commit hash, never tracked as a go.mod tool
dependency or through a tools.go file. golangci-lint is unchanged; it
stays pinned only by its image digest.
Model: opus-5-5