Rewrite TODO.md sentence by sentence (closes #135)

TODO.md is the project's own task list, judged by the same rules as
README.md: short sentences, lists as bullets, nothing a newcomer reads
twice. Every completed step is kept with its date and its issue or
branch, and every fact the old entries recorded is kept too, in short
sentences. The 2026-07-22 policy-compliance checklist is folded into
the step that did the work, and the accepted divergence from the
layout policy gets a section of its own. Workflow, Status and Next
Step keep their rules unchanged.

Model: fable-5-1

TODO.md

@@ -136,9 +136,9 @@ are known.
   defines the phase. A line too wide for the terminal loses its bar first, then
   its rate or those words, so the phase, progress, elapsed time and ETA stay
   whole. On an 80-column terminal, at counts like those of README's example, the
-  content phase's `checks` and `reads` lines were too wide for those words. That
+  content phase's displays for its checks and its reads lost those words. That
-  held at most elapsed times and ETAs in minutes. Every other phase kept them
+  happened for most elapsed times and ETAs in minutes. Every other phase kept
-  whenever the elapsed time and the ETA were both in minutes. The content
+  them whenever the elapsed time and the ETA were both in minutes. The content
   phase's last partial batch is written under a display of its own (2026-10-16,
   https://git.eeqj.de/sneak/sfdupes/issues/125)
 
@@ -227,10 +227,10 @@ are known.
     every build (2026-10-15, https://git.eeqj.de/sneak/sfdupes/issues/95)
 
 - With `-x`, an operand under another operand is no longer dropped when the
-  outer operand's walk cannot reach it. That is the case when a directory from
+  outer operand's walk cannot reach it. That is the case when a directory
-  the inner operand up to, but not including, the outer one is on a different
+  between the two operands, the inner one included, is on a different filesystem
-  filesystem than the outer one. The inner operand is then walked on its own.
+  than the outer one. The inner operand is then walked on its own. For a
-  For a regular-file operand the directories checked start at its directory. The
+  regular-file operand the directories checked start at its directory. The
   records of files gone from below it are deleted (2026-10-14,
   https://git.eeqj.de/sneak/sfdupes/issues/106)
 
@@ -442,9 +442,9 @@ are known.
   installing. On a mismatch it printed both paths and both versions and exited
   non-zero; it did not reorder `PATH` or delete anyone's binary. The `--version`
   call kept its stderr and was bounded by `timeout(1)` where that exists. `git`,
-  `make` and `go` kept presence-only checks. It was verified by bootstrapping
+  `make` and `go` kept presence-only checks. The version check was verified by
-  this host from v2.10.1 to v2.12.2, and again to a no-op. Stub runs of the
+  bootstrapping this host from v2.10.1 to v2.12.2, and again to a no-op. Stub
-  script under `dash` covered:
+  runs of the script under `dash` covered:
     - a thirteen-input version-parse matrix;
     - a shadowed install, which must exit non-zero;
     - an install destination not on `PATH`;
@@ -488,9 +488,9 @@ are known.
   to exit 1, and cobra's own argument and flag errors to exit 2. So a runtime
   failure is never reported as a usage error, nor printed with the usage text.
   `main_test.go` drives the CLI in-process and asserts the exit codes from
-  README "Error handling" and the stdout/stderr split. That includes a fatal
+  README "Error handling" and the stdout/stderr split. It also checks that a
-  error after the database is open leaving no `-wal` or `-shm` file behind, for
+  fatal error after the database is open leaves no `-wal` or `-shm` file behind,
-  `scan`, `report` or `trees` (2026-08-09, branch `db-close-on-fatal`,
+  for `scan`, `report` or `trees` (2026-08-09, branch `db-close-on-fatal`,
   https://git.eeqj.de/sneak/sfdupes/issues/4)
 
 - `golangci-lint` updated to v2.12.2 with the canonical config, merged as