Cut the narration from TODO.md and the script and Dockerfile comments (closes #49)

Completed Steps entries keep what landed, the traps, every disclosure
and every record that a check ran; the argument and history go, with
bare issue numbers turned into full links. Comment blocks in script/,
Dockerfile and Dockerfile.lint keep the trap and drop the defence of
past decisions. TODO.md Workflow now branches from next, targets next,
and leaves merging next to main to the owner. Only comments and
Markdown change.

Model: opus-5-5

script/verify-lint-image-pin

@@ -2,23 +2,16 @@
 # script/verify-lint-image-pin: fail unless the golangci-lint image
 # referenced by Dockerfile.lint and the one referenced by the main
 # Dockerfile's lint stage are the same image at the same digest. Our own
-# extension to scripts-to-rule-them-all, not one of its entrypoints.
+# extension to scripts-to-rule-them-all, not one of its entrypoints; run
+# as a gate in both files. Nothing else keeps the two pins in sync, and
+# a bump applied to one alone would lint the same tree against different
+# rulesets, both green.
 #
-# The linter version is pinned in two independent files. That is the
-# shape #42 turned into a build failure rather than tolerate: nothing
-# else keeps the two in sync, and a bump applied to one file alone would
-# leave `make lint` and the fail-fast lint stage of `make docker`
-# linting the same tree against different rulesets, both green. This is
-# the single guard that stops it, run as a gate in both files.
+# Do not hardcode the expected digest here: that is a third copy to keep
+# in sync.
 #
-# It deliberately restates neither pin. A hardcoded expected digest here
-# would be a third copy — one more thing to bump, and the same drift one
-# file further out. It compares the two files to each other and knows
-# nothing about which version is correct.
-#
-# A reference that cannot be read is a hard failure, not a skip: a
-# comparison of two empty strings succeeds, which would turn this guard
-# into exactly the unearned green it exists to prevent.
+# A reference that cannot be read is a hard failure, not a skip: two
+# empty strings compare equal.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"