agent: dial the manager by a fleet DNS name (manager.fleet.lab)

The agent's baked default pointed at the PUBLIC admin-UI name
(diskless-server.bitasylum.org), which resolves to the serving host's outbound IP
— unreachable from the fleet LAN. There's no split-horizon to "automate": the
manager agent plane is just another *.fleet.lab, served by the fleet dnsmasq like
boot/nvme/audit.

- serving/.env.example: MGMT_HOST=manager.fleet.lab.
- serving/docker-compose.yml: dnsmasq --address=/${MGMT_HOST}/${SERVER_IP}.
- files/agent/agent.env + main.go default: FLEET_AGENT_MANAGER=manager.fleet.lab:9600.
- server-pki.sh: AGENT_SANS default -> manager.fleet.lab (cert SAN matches the
  baked name, so no FLEET_AGENT_SERVER_NAME override).
- docs/TODO #14 gotcha #4 updated: fleet name, not the IP+server-name workaround.

The public diskless-server.bitasylum.org stays the ADMIN-UI name (Traefik/:443).

docs/TODO.md

@@ -1447,12 +1447,17 @@ the design forks resolved:
   3. **Distroless perms.** The nonroot manager (uid 65532) can't read `pki/agent/*`
      if created `0600` by the host user → `open …/server.crt: permission denied`.
      `chown 65532` the agent PKI (as with the fleet-data volume).
-  4. **Wrong manager IP / split-horizon DNS.** `diskless-server.bitasylum.org`
-     resolved to the serving host's OUTBOUND IP (`no route to host` from the fleet
-     LAN). Bench workaround: `FLEET_AGENT_MANAGER=<fleet-lan-ip>:9600` +
-     `FLEET_AGENT_SERVER_NAME=<dns-name>` (dial the IP, verify the cert's SAN).
-     PROD FIX (not code): fleet dnsmasq `--address=/<name>/<fleet-lan-ip>` so the
-     baked default resolves on the host VLAN.
+  4. **Manager wasn't a fleet name.** The agent's baked default pointed at the
+     PUBLIC admin-UI name (`diskless-server.bitasylum.org`), which resolves to the
+     serving host's OUTBOUND IP → `no route to host` from the fleet LAN. FIX: the
+     agent plane is now just another `*.fleet.lab` — `manager.fleet.lab` (`MGMT_HOST`
+     in serving/.env), served by the fleet dnsmasq to `SERVER_IP` exactly like
+     boot/nvme/audit (`--address=/${MGMT_HOST}/${SERVER_IP}`), baked as
+     `FLEET_AGENT_MANAGER` and set as the agent server cert SAN (`AGENT_SANS`). No
+     per-host override, no server-name hack. (The public `diskless-server…` name
+     stays the ADMIN-UI name on Traefik/:443 — a separate plane.) The transient
+     bench workaround was `FLEET_AGENT_MANAGER=<ip> + FLEET_AGENT_SERVER_NAME=<name>`;
+     no longer needed.
   5. **Host not in the manager's inventory** → `PermissionDenied` (surfaced as a
      bare `EOF` on the agent before the fix). A host enrolled OUT OF BAND (bench
      broker / migrated fleet) has no inventory row. FIX: `fleet-manager