Records the trusted-proxy gating (#88), the hop cap (#124) and the
bounded scan (#133), and corrects the Workflow section, which still
described branching from main and committing TODO.md alongside the
work — both contradicted by the branch-per-issue-onto-next model and
by the decision on #112 that issue branches leave this file alone.
