Rewrite TODO.md sentence by sentence (closes #135)

TODO.md is the project's own task list, judged by the same rules as
README.md: short sentences, lists as bullets, nothing a newcomer reads
twice. Every completed step is kept with its date and its issue or
branch, and every fact the old entries recorded is kept too, in short
sentences. The 2026-07-22 policy-compliance checklist is folded into
the step that did the work, and the accepted divergence from the
layout policy gets a section of its own. Workflow, Status and Next
Step keep their rules unchanged.

Model: fable-5-1

TODO.md

@@ -136,9 +136,9 @@ are known.
   defines the phase. A line too wide for the terminal loses its bar first, then
   its rate or those words, so the phase, progress, elapsed time and ETA stay
   whole. On an 80-column terminal, at counts like those of README's example, the
-  content phase's displays for its checks and its reads lost those words. That
-  happened for most elapsed times and ETAs in minutes. Every other phase kept
-  them whenever the elapsed time and the ETA were both in minutes. The content
+  content phase's `checks` and `reads` lines were too wide for those words. That
+  held at most elapsed times and ETAs in minutes. Every other phase kept them
+  whenever the elapsed time and the ETA were both in minutes. The content
   phase's last partial batch is written under a display of its own (2026-10-16,
   https://git.eeqj.de/sneak/sfdupes/issues/125)
 
@@ -227,10 +227,10 @@ are known.
     every build (2026-10-15, https://git.eeqj.de/sneak/sfdupes/issues/95)
 
 - With `-x`, an operand under another operand is no longer dropped when the
-  outer operand's walk cannot reach it. That is the case when a directory
-  between the two operands, the inner one included, is on a different filesystem
-  than the outer one. The inner operand is then walked on its own. For a
-  regular-file operand the directories checked start at its directory. The
+  outer operand's walk cannot reach it. That is the case when a directory from
+  the inner operand up to, but not including, the outer one is on a different
+  filesystem than the outer one. The inner operand is then walked on its own.
+  For a regular-file operand the directories checked start at its directory. The
   records of files gone from below it are deleted (2026-10-14,
   https://git.eeqj.de/sneak/sfdupes/issues/106)
 
@@ -442,9 +442,9 @@ are known.
   installing. On a mismatch it printed both paths and both versions and exited
   non-zero; it did not reorder `PATH` or delete anyone's binary. The `--version`
   call kept its stderr and was bounded by `timeout(1)` where that exists. `git`,
-  `make` and `go` kept presence-only checks. The version check was verified by
-  bootstrapping this host from v2.10.1 to v2.12.2, and again to a no-op. Stub
-  runs of the script under `dash` covered:
+  `make` and `go` kept presence-only checks. It was verified by bootstrapping
+  this host from v2.10.1 to v2.12.2, and again to a no-op. Stub runs of the
+  script under `dash` covered:
     - a thirteen-input version-parse matrix;
     - a shadowed install, which must exit non-zero;
     - an install destination not on `PATH`;
@@ -488,9 +488,9 @@ are known.
   to exit 1, and cobra's own argument and flag errors to exit 2. So a runtime
   failure is never reported as a usage error, nor printed with the usage text.
   `main_test.go` drives the CLI in-process and asserts the exit codes from
-  README "Error handling" and the stdout/stderr split. It also checks that a
-  fatal error after the database is open leaves no `-wal` or `-shm` file behind,
-  for `scan`, `report` or `trees` (2026-08-09, branch `db-close-on-fatal`,
+  README "Error handling" and the stdout/stderr split. That includes a fatal
+  error after the database is open leaving no `-wal` or `-shm` file behind, for
+  `scan`, `report` or `trees` (2026-08-09, branch `db-close-on-fatal`,
   https://git.eeqj.de/sneak/sfdupes/issues/4)
 
 - `golangci-lint` updated to v2.12.2 with the canonical config, merged as