docs: refresh HANDOFF.md through batch 25 and the podman-build arc

[pofallon]

State: d9f7202, ledger 232 behaviors / 1 open nonconformance (#706), with #710 and #706 open and unassigned.

The mining arc is out of upstream files

Batch 25 closed cli.test — the reference's Feature-authoring surface, permanently out of scope for deacon — so it produced a guard rather than cases: ledger_covers_every_subcommand. The queue is reordered around that, with #710 as item 1 and an explicit do not design before measuring on it, because two localhost/ fixes were already guessed there and both were wrong.

Five rules, all paid for this stretch

• A green LANE can report coverage it does not have — verify which BINARY did the work. chore(ci): run deacon's build tests against Podman (#30) #705's "34 of 36 passing on Podman" was fiction. The shim technique that settles it is written down, along with both traps: use a fresh config hash (a cache hit exits 0 having invoked nothing), and know that the existing --docker-path /nonexistent/… test passes throughout.
• The same prefix can be right and wrong on the same day; what decides it is who PARSES it. localhost/ applied three times, wrong twice — compose client vs podman tag vs a podman build build-arg are three different consumers.
• If a fix only changes the ERROR STRING, it is at the wrong layer. X: image not known → docker.io/library/X: image not known was the tell, and it took two CI cycles to read it as a signal rather than as progress.
• A test that verifies by shelling out must use the runtime under test. integration_up_exec_identity already had the helper and the comment; grep before writing.
• Unmasking a false green makes the number WORSE before it means anything. 34/34 (false) → 24/10 → 26/6 → 26/26.

Two traps

• A squash merge concatenates COMMIT messages, so a stale Closes #NNN survives a rewritten PR body. This closed fix(up): the compose path never applies podman's localhost/ image qualification, so a Feature-extended image cannot be found #706 while it was unfixed — fix(docker): read podman's image-not-found wording #707 opened expecting to fix it, the measurement said otherwise, the body was rewritten, and the first commit's keyword closed it anyway on merge. Reopened with an explanation. Check issue state after any merge whose scope changed mid-flight.
• Podman delegates compose to an EXTERNAL provider — docker's own docker-compose plugin on the runner. So a compose image: is parsed by docker-compose, and the built image is in no podman store.

Also links #706's ledger row to #710 as the general case — the tidy-up deferred during #709 rather than churn a CI cycle.

Docs only; ledger and census guards green.

🤖 Generated with Claude Code

https://claude.ai/code/session_016SFzA2sTh2EpX8MZU3TWNS