Rewrite TODO.md sentence by sentence (closes #135)

TODO.md is the project's own task list, judged by the same rules as
README.md: short sentences, lists as bullets, nothing a newcomer reads
twice. Every completed step is kept with its date and its issue or
branch, and every fact the old entries recorded is kept too, in short
sentences. The 2026-07-22 policy-compliance checklist is folded into
the step that did the work, and the accepted divergence from the
layout policy gets a section of its own. Workflow, Status and Next
Step keep their rules unchanged.

Model: fable-5-1

TODO.md

@@ -37,7 +37,7 @@ are known.
 - `README.md` rewritten from scratch, sentence by sentence, as a newcomer reads
   it. It leads with what the program is and how to use it. A reference section
   covers every setting and every subcommand. Development and testing come last.
-  Every statement was checked against the code on `next`. Three comments in
+  Every statement was checked against the code on `next`. Five comments in
   `main_test.go` cite "Settings", where their rules now live (2026-10-26,
   https://git.eeqj.de/sneak/sfdupes/issues/135)
 
@@ -90,12 +90,13 @@ are known.
     README says the same (2026-10-18,
     https://git.eeqj.de/sneak/sfdupes/issues/109)
 
-- Release rule set. Until 1.0, each tip of `main` that passes the build gets the
+- The release rule was set. Until 1.0, each tip of `main` that passes the build
-  next `v0.0.N` tag. `go install sneak.berlin/go/sfdupes@latest` then installs
+  gets the next `v0.0.N` tag. `go install sneak.berlin/go/sfdupes@latest` then
-  it. `go.mod` retracts `v0.0.1`, the early build without a database. When the
+  installs it. `go.mod` retracts `v0.0.1`, the early build without a database.
-  linker set no version, `sfdupes --version` prints the version Go recorded in
+  When the linker set no version, `sfdupes --version` prints the version Go
-  the binary. That is the tag, or the pseudo-version of a `go install` build. It
+  recorded in the binary. That is the tag, or the pseudo-version of a
-  prints `dev` only when neither is known. README "Install" documented:
+  `go install` build. It prints `dev` only when neither is known. README
+  "Install" documented:
     - the rule;
     - what `@main` and `v0.0.1` give;
     - how to check an installed binary.
@@ -259,7 +260,7 @@ are known.
       gone, and the build stage installs `git` and `make` itself;
     - a new push cancels the workflow's older run on the same branch, and a run
       stops after 20 minutes;
-    - a stray editor-settings file is deleted.
+    - a coding agent's settings file is deleted.
 
     Since https://git.eeqj.de/sneak/sfdupes/issues/109 two steps come before
     `ARG CACHEBUST`:
@@ -321,8 +322,8 @@ are known.
   `script/` pass a new `CACHEBUST` value, so theirs always run (2026-10-04,
   https://git.eeqj.de/sneak/sfdupes/issues/39)
 
-- `make fmt` and `make fmt-check` run `prettier` over all Markdown, and CI
+- `make fmt` and `make fmt-check` run `prettier` over all Markdown, and the
-  checks it. All Markdown was reformatted (2026-10-04,
+  Gitea workflow checks it. All Markdown was reformatted (2026-10-04,
   https://git.eeqj.de/sneak/sfdupes/issues/19)
 
 - `script/lint` writes no image, so a run no longer leaves an untagged one
@@ -427,8 +428,8 @@ are known.
   `dev`. `.dockerignore` sends `.git` without `.git/config`. The build stage
   stamps the `VERSION` build argument, else `git describe --tags --always`. It
   fails if the context carries `.git` and the version is still empty, `dev` or
-  `unknown`. CI checks out the full history (`fetch-depth: 0`), so it stamps the
+  `unknown`. The Gitea workflow checks out the full history (`fetch-depth: 0`),
-  same value as `make build` (2026-10-02, branch `next`,
+  so it stamps the same value as `make build` (2026-10-02, branch `next`,
   https://git.eeqj.de/sneak/sfdupes/issues/67)
 
 - The 1 KiB end-window sampling was replaced with the hashes chosen by file