docs(decisions): record the rebase and the README merge decision

#18 has landed, so this branch's "PR #18 must merge first" caveat was stale --
corrected to say what is now true and, more importantly, what is still NOT:
no image has been built or pushed, so the digest this branch pins resolves to
nothing.

Also records the one real conflict the rebase hit and how it was resolved.
#18's README carried a blockquote saying the 4th admission rule pinning the
init container's command "is not in this branch". It IS in this branch
(trigger-initcontainers-must-be-the-committed-clone-step, plus the
ephemeralContainers and env/envFrom rules beside it), so keeping #18's wording
would have left main documenting an open hole that had just been closed.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

decisions/2026-09-29-conformance-job-template.md

@@ -333,15 +333,37 @@ visible in the policy's prose — which is careful, accurate about what it *does
 explicit that it is "THE SECURITY BOUNDARY" — only in what the CLI did with a tampered resource. A
 policy is only as trustworthy as its negative fixtures.
 
+### Addendum — rebased onto `main` after #18 landed (2026-09-29)
+
+This branch originally appended its handoff to `DECISIONS-LOG.md`, which is why it was
+`mergeable: false`: every branch appended to that file's same last hunk. The append is now this
+file (see `decisions/README.md`).
+
+The rebase onto post-#18 `main` hit one real content conflict — `conformance/incluster/README.md`,
+where #18 and this branch had each rewritten the same bullet list. Resolved by keeping #18's
+`Containerfile` / `conformance-clone` / `build-image.sh` bullets and this branch's
+`chainsaw-job.yaml` bullet, since this branch is what makes the Job a rendered run template.
+
+One of #18's paragraphs had to be **rewritten rather than kept**: its `conformance-clone` bullet
+carried a blockquote saying *"This file is half a fix … a 4th policy rule demanding `command:
+["/usr/local/bin/conformance-clone"]` with no `args` … is **not** in this branch."* That rule **is**
+in this branch — `trigger-initcontainers-must-be-the-committed-clone-step`, plus the
+`ephemeralContainers` and `env`/`envFrom` rules beside it. Leaving #18's wording would have left
+`main` documenting an open hole that had just been closed, which is the same
+documentation-disagrees-with-mechanism failure this repo keeps hitting. No code changed in the
+rebase: every file but that README is byte-identical to the pre-rebase tip.
+
 ## What I did NOT verify
 
 - **Nothing here has ever executed against a cluster.** The `conformance-runner` image does not
   exist (plan §3 item 1), so the Job cannot be submitted, and the init container's
   clone/fetch/assert sequence, the credential helper and the envelope-over-`kubectl-logs` path are
   all **unexercised**. The envelope itself is verified; its transport is not.
-- **PR #18 must merge first.** The image digest and `/usr/local/bin/conformance-clone` both arrive
+- **PR #18 has since merged** (`cac5c9f`), so `/usr/local/bin/conformance-clone` and the image are
-  with it. If that path is missing or named differently, the init container fails to start; if it
+  now on `main` and this branch was rebased onto them. What that changes is only *availability*:
-  is present but the image is not the pinned digest, admission denies the Job.
+  if the path were missing or named differently the init container would fail to start, and if the
+  image is not the pinned digest admission denies the Job. **Neither has been exercised** — no
+  image has been built or pushed, so the digest this branch pins still resolves to nothing.
 - **Secret `conformance-git-readonly` does not exist** (plan §3 item 6, operator action). Only its
   name is referenced here.
 - **`uid 65532`** is asserted by the Job's `runAsUser`/`fsGroup`; the image that must provide it has