Bring TODO.md up to date with next and the tracker (closes #13)

The workflow lines now say who merges where: clawbot squash-merges
reviewed issue PRs into next, only sneak merges next into main, and a
deploy is a squash commit from main onto prod, never automatic.

Status lists what is on next today: the repo standards, interface
detection on Linux and macOS with the macOS VPN pane shown only while a
VPN carries the default route, the Starlink status lines, the version
stamp, and CI running script/cibuild. Next Step is the owner's merge of
the milestone PR and a first run on a real Mac.

Model: opus-5-5

TODO.md

@@ -5,38 +5,42 @@ One issue per unit of work, one branch and one PR per issue:
 - ensure a tracked issue exists with a definition of done
 - branch from `next` (never from `main`)
 - do the work; open a PR based on `next` (never on `main`)
-- pass an independent review, then the change is squash-merged into `next`
+- pass an independent review, then `clawbot` squash-merges it into `next`
 - push; nothing stays local-only
 
-`next` is the branch for the next milestone and must stay green and
-mergeable to `main` without notice. Only `sneak` merges `next` into
-`main`, and for now only `sneak` merges into `next`. No commits land
-directly on `main` or `next` — only merges via PRs.
+`next` is the branch for the next milestone and must stay green and mergeable to
+`main` without notice. Only `sneak` merges `next` into `main`. No commits land
+directly on `main` or `next`, only merges via PRs. A deploy is a squash commit
+from `main` onto `prod`; `prod` never follows `main` automatically.
 
-Issue branches do NOT touch this file — it is maintained on `next`.
-Every branch editing `TODO.md` conflicts with every other.
+Other issue branches do not touch this file; it changes only in its own PR to
+`next`, because every branch editing `TODO.md` conflicts with every other.
 
 # Status
 
-The repository has been brought up to current repo standards: `script/`
-Scripts to Rule Them All entrypoints with the `Makefile` reduced to thin
-shims, a `Dockerfile` whose `lint` and `test` phases gate the build, a
-`.gitea/workflows/` CI workflow running `script/cibuild`, the vendored
-`.golangci.yml`, `REPO_POLICIES.md`, `.editorconfig`, `.dockerignore`, a
-`LICENSE` file, and a comprehensive `.gitignore`.
+On `next`:
 
-Lint is clean under the standard `default: all` configuration, with the
-findings fixed rather than suppressed. The only annotations are
-justified `//nolint:gosec` on the `ping`/`curl` subprocess calls (G204)
-and on opening the operator-chosen log file (G304): fixed argv with no
-shell, so these are false positives, annotated as the reference repos do.
+- Repo standards (https://git.eeqj.de/sneak/rtnetmon/issues/1): `script/`
+  entrypoints with the `Makefile` as thin shims, lint and tests run in Docker as
+  phases that gate the image build, the vendored `.golangci.yml`, and
+  `REPO_POLICIES.md`.
+- Interface detection on Linux and macOS
+  (https://git.eeqj.de/sneak/rtnetmon/issues/2): one pane or two, from the
+  interfaces present. On macOS the VPN pane appears only while a VPN carries the
+  default route (https://git.eeqj.de/sneak/rtnetmon/issues/8).
+- Starlink status lines under the physical interface's pane when a Starlink dish
+  answers (https://git.eeqj.de/sneak/rtnetmon/issues/3).
+- A version stamp: built with `make build` or a plain `docker build .`, the
+  binary logs its git tag or short commit at startup
+  (https://git.eeqj.de/sneak/rtnetmon/issues/10).
+- CI that runs `script/cibuild` on every push
+  (https://git.eeqj.de/sneak/rtnetmon/issues/12).
 
 # Next Step
 
-Feature work, each on its own branch and PR from `next`:
-
-- https://git.eeqj.de/sneak/rtnetmon/issues/2 — macOS support:
-  VPN-aware interface detection and a single-interface UI when only one
-  interface exists.
-- https://git.eeqj.de/sneak/rtnetmon/issues/3 — show Starlink status
-  lines when Starlink is the non-VPN gateway.
+- `sneak` merges the milestone PR, https://git.eeqj.de/sneak/rtnetmon/pulls/6,
+  carrying `next` into `main`.
+- A first run on a real Mac of what is on `next` now. The fix for
+  https://git.eeqj.de/sneak/rtnetmon/issues/8 has not run on a Mac, and none of
+  the machines rtnetmon is developed and tested on is one, so that run is
+  `sneak`'s.