Record the stale-branch triage and advance TODO.md (closes #71)

Twelve stale remote branches retired. Nine were ancestors of main with no
unique commits; golangci-v2.12.2 pointed at a tree byte-identical to the
one main's cc58583 already carries; fix/sync-snapshot-cleanup's one-line
change is present on main; and feature/restore-progress-bar was not only
superseded but regressive, since its diff deletes the #28 regression test
that landed separately.

Neither of the two branches that looked like unlanded correctness fixes
turned out to hold one, and in both cases main had moved past them by a
decision already recorded in the tracker.

fix/ctime-scanner-population would have restored a field that no longer
exists: ctime was removed outright by 1c72a37 (#54/#55). It never
participated in change detection either - the scanner compares size,
mtime, mode, uid and gid, exactly the five fields ARCHITECTURE.md
documents - so the feared dedup/data-loss failure was not reachable.

fix/sql-injection-whitelist would have reverted bfd7334, which replaced
a table-name allowlist with regex sanitization in response to review
feedback on PR #32, and would have broken main: its allowlist omits the
snapshots table, whose count main reads with the error discarded, so the
figure would silently have become zero. Exposure on main is nil -
getTableCount is unexported, every call site passes a literal, and the
sanitizing pattern admits no quote, space, semicolon or paren.

feature/daemon-mode is untouched pending the scope decision in #94.

The full disposition inventory, with the evidence for each branch, is
recorded on #71.

TODO.md

@@ -14,11 +14,46 @@ pre-1.0
 
 # Next Step
 
-Triage the stale remote branches (issue #71): for each, merge the work
-or delete the branch.
+Define remaining scope for a first tagged release and cut v0.1.0.
 
 # Completed Steps
 
+- 2026-08-09: Triaged all fifteen stale remote branches (issue #71) and
+  deleted fourteen of them; the full per-branch disposition with
+  evidence is recorded on that issue. Method mattered more than the
+  outcome here: a three-dot `git diff main...branch` diffs from the
+  merge base, so it replays everything that landed on `main` after the
+  branch diverged and makes any old branch look like it holds unlanded
+  work. That artifact is what made `golangci-v2.12.2` appear to carry
+  126 files of unpushed changes when its tree was byte-identical to
+  `main`'s. Every containment claim here therefore rests on two-dot tip
+  diffs, tree-hash equality, `git cherry`, and `git branch -r --merged`.
+  Nine branches were plain ancestors of `main` with zero `git cherry`
+  `+` commits. `golangci-v2.12.2` had landed squashed as `cc58583`,
+  whose tree hash equals the branch tip's exactly; note the hash
+  recorded in the issue had gone stale because `main` advanced, so the
+  check had to be redone rather than repeated.
+  `fix/sync-snapshot-cleanup` was redundant, its one line already on
+  `main` in `syncWithRemote`. `feature/restore-progress-bar` was
+  superseded by `printRestoreProgress` and the disk-backed blob cache,
+  and had become actively regressive — it would have deleted
+  `internal/blobgen/compress_test.go`, the #28 regression test that
+  landed separately. The two branches this issue was filed for both
+  turned out to be closed questions that `main` had already moved past
+  by a recorded decision, so neither was landed and no regression test
+  was owed: `ctime` no longer exists anywhere in the codebase after
+  `1c72a37` removed the column, the `File.CTime` field and every use
+  (#54/#55), and change detection compares size, mtime, mode, uid and
+  gid only, exactly as `ARCHITECTURE.md` documents — so the
+  silently-skipped-file data-loss risk that made this a 1.0 item does
+  not exist. The SQL allow-list branch would have reverted `bfd7334`,
+  which replaced that very allow-list with regex sanitisation on review
+  feedback, and would have broken `getTableCount("snapshots")` because
+  its allow-list omits that table. `feature/daemon-mode` is untouched
+  and deferred to #94 pending an owner decision, so it is the one
+  branch besides `main` still on the remote. The stale `TODO.md` entry
+  named in the issue needed no fix: `e496aa3` had already removed it.
+  No product code changed.
 - 2026-08-09: Adopted the remaining upstream `CHECK_EPOCH` hardening
   (issue #91), closing the gap #85 knowingly left open. Four changes,
   all four decided as adopt upstream in `sneak/prompts` #26. (1) Each
@@ -182,4 +217,4 @@ or delete the branch.
 
 # Future Steps
 
-- Define remaining scope for a first tagged release and cut v0.1.0.
+None queued; the release-scoping item is now the Next Step.