agent: dial the manager by a fleet DNS name (manager.fleet.lab)

The agent's baked default pointed at the PUBLIC admin-UI name
(diskless-server.bitasylum.org), which resolves to the serving host's outbound IP
— unreachable from the fleet LAN. There's no split-horizon to "automate": the
manager agent plane is just another *.fleet.lab, served by the fleet dnsmasq like
boot/nvme/audit.

- serving/.env.example: MGMT_HOST=manager.fleet.lab.
- serving/docker-compose.yml: dnsmasq --address=/${MGMT_HOST}/${SERVER_IP}.
- files/agent/agent.env + main.go default: FLEET_AGENT_MANAGER=manager.fleet.lab:9600.
- server-pki.sh: AGENT_SANS default -> manager.fleet.lab (cert SAN matches the
  baked name, so no FLEET_AGENT_SERVER_NAME override).
- docs/TODO #14 gotcha #4 updated: fleet name, not the IP+server-name workaround.

The public diskless-server.bitasylum.org stays the ADMIN-UI name (Traefik/:443).

serving/fleet-manager/server-pki.sh

@@ -17,7 +17,7 @@
 # Usage:  server-pki.sh
 #   env overrides:
 #     OUT=./pki/agent                     output dir
-#     AGENT_SANS=diskless-server.bitasylum.org,10.0.0.1   SANs hosts dial (DNS/IP, comma-sep)
+#     AGENT_SANS=manager.fleet.lab,10.0.0.1   SANs hosts dial (DNS/IP, comma-sep)
 #     FLEET_CA_URL=https://ca.fleet.lab:8443
 #     FLEET_CA_ROOT=../dot1x-bench/pki/root_ca.crt
 #     STEP_PROVISIONER=enrol
@@ -26,7 +26,7 @@
 set -euo pipefail
 
 OUT=${OUT:-./pki/agent}
-AGENT_SANS=${AGENT_SANS:-diskless-server.bitasylum.org}
+AGENT_SANS=${AGENT_SANS:-manager.fleet.lab}
 FLEET_CA_URL=${FLEET_CA_URL:-https://ca.fleet.lab:8443}
 FLEET_CA_ROOT=${FLEET_CA_ROOT:-../dot1x-bench/pki/root_ca.crt}
 FLEET_CA_INTERMEDIATE=${FLEET_CA_INTERMEDIATE:-../dot1x-bench/pki/intermediate_ca.crt}