Cut the narration from TODO.md and the script and Dockerfile comments (closes #49)

Completed Steps entries keep what landed, the traps, every disclosure
and every record that a check ran; the argument and history go, with
bare issue numbers turned into full links. Comment blocks in script/,
Dockerfile and Dockerfile.lint keep the trap and drop the defence of
past decisions. TODO.md Workflow now branches from next, targets next,
and leaves merging next to main to the owner. Only comments and
Markdown change.

Model: opus-5-5

script/lint

@@ -1,23 +1,17 @@
 #!/bin/sh
 # script/lint: run the linter. golangci-lint is never installed on a
-# host: it runs via docker only, one way, everywhere — this builds
-# Dockerfile.lint, which COPYs the repo into the digest-pinned
-# golangci-lint image and lints as a build step, so a successful build
-# is a clean lint. The only prerequisite is a working docker. The gate
-# steps make no network calls of their own, but Dockerfile.lint runs
-# `go mod download` above them, so a cold cache does reach the network
-# (as does pulling the pinned image); that layer stays cached, and once
-# it is warm this runs offline until go.mod or go.sum changes.
+# host: this builds Dockerfile.lint, which copies the repo into the
+# digest-pinned golangci-lint image and lints as a build step, so a
+# successful build is a clean lint. A cold cache needs the network to
+# pull the image and for `go mod download`; once warm this runs offline
+# until go.mod or go.sum changes.
 #
-# CHECK_EPOCH is what makes the result mean anything. Without it docker
-# serves the gate layers from cache on an unchanged tree and this exits
-# 0 in well under a second having run no linter. The PID is in the value
-# as well as the epoch because two lint runs land inside the same second
-# easily, and `date +%s` alone would cache the second one.
+# Without a fresh CHECK_EPOCH docker serves the gate layers from cache
+# on an unchanged tree and this exits 0 having run no linter. The PID is
+# in the value because two lint runs land inside the same second easily.
 #
-# The result is the build's exit status and the image is never used, so
-# --output=type=cacheonly writes none. Without it every run spends
-# seconds exporting an image and leaves it behind untagged.
+# The image is never used, so --output=type=cacheonly writes none;
+# without it every run leaves an untagged image behind.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"