Cut the narration from TODO.md and the script and Dockerfile comments (closes #49)

Completed Steps entries keep what landed, the traps, every disclosure
and every record that a check ran; the argument and history go, with
bare issue numbers turned into full links. Comment blocks in script/,
Dockerfile and Dockerfile.lint keep the trap and drop the defence of
past decisions. TODO.md Workflow now branches from next, targets next,
and leaves merging next to main to the owner. Only comments and
Markdown change.

Model: opus-5-5

script/bootstrap

@@ -1,14 +1,9 @@
 #!/bin/sh
 # script/bootstrap: install all dependencies needed to build and develop
-# this repo. Idempotent: every install is guarded by a check so already
-# installed tools are skipped. Base tooling comes from nix, apt, brew,
-# or apk (detected in that order); assumes nothing is present (not git,
-# make, or go). Neither the linter nor the Markdown formatter is
-# installed: golangci-lint (script/lint) and prettier (script/fmt,
-# script/fmt-check) run via docker only, pinned by hash, so their only
-# prerequisite is a working docker — which is warned about, not
-# installed, because everything except linting, formatting and
-# make test-race works without it.
+# this repo. Idempotent; assumes nothing is present (not git, make, or
+# go). Base tooling comes from nix, apt, brew, or apk (detected in that
+# order). golangci-lint and prettier are never installed: they run via
+# docker only (script/lint, script/fmt, script/fmt-check).
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -63,22 +58,15 @@ missing() {
 main() {
     cd "$ROOT"
 
-    # System tooling, deliberately unpinned: these come from the host
-    # package manager and whatever version it ships is what the host
-    # gets, so a presence check is the right check. The repo pins no
-    # system toolchain versions — the Go language version is governed by
-    # go.mod, and builds that must be reproducible run in the Docker
-    # image, whose base images are pinned by digest.
+    # Deliberately unpinned, so presence is the whole check: go.mod
+    # governs the Go version, and reproducible builds run in the
+    # digest-pinned Docker images.
     if missing git; then pkg_install git git git git; fi
     if missing make; then pkg_install gnumake make make make; fi
     if missing go; then pkg_install go golang go go; fi
 
-    # Linting and Markdown formatting run via docker only, so docker is
-    # their prerequisite rather than something bootstrap installs. Warn,
-    # do not fail: everything except `make lint`, `make fmt`,
-    # `make fmt-check` and `make test-race` — and, through them,
-    # `make check`, `make docker` and the pre-commit hook — works
-    # without it.
+    # Warn, do not fail: only the targets named below, and the
+    # pre-commit hook, need docker.
     if missing docker; then
         echo "bootstrap: WARNING: docker not found; make lint, make fmt," >&2
         echo "bootstrap: make fmt-check, make check, make docker and" >&2