agent: dial the manager by a fleet DNS name (manager.fleet.lab)

The agent's baked default pointed at the PUBLIC admin-UI name
(diskless-server.bitasylum.org), which resolves to the serving host's outbound IP
— unreachable from the fleet LAN. There's no split-horizon to "automate": the
manager agent plane is just another *.fleet.lab, served by the fleet dnsmasq like
boot/nvme/audit.

- serving/.env.example: MGMT_HOST=manager.fleet.lab.
- serving/docker-compose.yml: dnsmasq --address=/${MGMT_HOST}/${SERVER_IP}.
- files/agent/agent.env + main.go default: FLEET_AGENT_MANAGER=manager.fleet.lab:9600.
- server-pki.sh: AGENT_SANS default -> manager.fleet.lab (cert SAN matches the
  baked name, so no FLEET_AGENT_SERVER_NAME override).
- docs/TODO #14 gotcha #4 updated: fleet name, not the IP+server-name workaround.

The public diskless-server.bitasylum.org stays the ADMIN-UI name (Traefik/:443).

files/agent/agent.env

@@ -6,10 +6,13 @@
 # environment by replacing this file (it is part of the immutable image, so a
 # change means a rebuild + re-sign, like any other baked config).
 
-# The fleet-manager agent plane (gRPC/mTLS). A DNS name, NOT a per-host value.
-# Reached from the authenticated host VLAN via the OPNsense L3 hop to the mgmt
-# plane (not the boot nginx). Set to your manager's real name:port.
-FLEET_AGENT_MANAGER=diskless-server.bitasylum.org:9600
+# The fleet-manager agent plane (gRPC/mTLS). A fleet DNS name (NOT per-host),
+# resolved by the serving dnsmasq like boot/nvme/audit — MGMT_HOST in serving/.env
+# points it at the manager's fleet-LAN address (this serving host now; a routable
+# mgmt address once the manager moves behind OPNsense L3 / k8s). Must match the
+# agent server cert SAN (server-pki.sh AGENT_SANS). This is the AGENT plane, NOT
+# the public admin-UI name (that's Traefik/Let's Encrypt on :443).
+FLEET_AGENT_MANAGER=manager.fleet.lab:9600
 
 # Fleet CA that verifies the manager's server cert. This is the SAME step-ca root
 # that signs the host TPM certs + the RADIUS server cert, so we reuse the in-place

files/agent/main.go

@@ -198,7 +198,7 @@ func logDown(down *fleetpb.ManagerDown) {
 // ---- config ----------------------------------------------------------------
 
 func loadConfig() config {
-	manager := env("FLEET_AGENT_MANAGER", "diskless-server.bitasylum.org:9600")
+	manager := env("FLEET_AGENT_MANAGER", "manager.fleet.lab:9600")
 	cfg := config{
 		manager:    manager,
 		serverName: env("FLEET_AGENT_SERVER_NAME", hostOf(manager)),