* chore(repo): track CI image bases and trim the TODO baseline

Dependabot now opens a monthly PR when the Ubuntu base digest of the CI
image recipe moves, so the runtime image no longer ages unnoticed.

The TODO review baseline repeated every earlier parity review already
indexed in docs/README.md. Keeping only the newest review brings TODO.md
under the TODO gate's 40,000-character limit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ci(dependabot): keep Ubuntu on 24.04 and exclude the Neon stage

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>