fleet-manager: document hardening status + remaining per-env items

DEPLOY.md gains a "Hardening status" section (done vs operator-to-close), and
TODO #14 records the deployment as CI-built + acme-cert + backup, with the open
items called out: network-segment the :9500/:9600 listeners to the mgmt net, run
server-pki.sh when the agent lands, choose :9500 vs a 443 proxy, and digest-pin
the images.

docs/TODO.md

@@ -1389,7 +1389,13 @@ the design forks resolved:
 - **Authorise pillar:** the enrol-broker (#11) folded in "alongside" — manager
   drives its admin plane over mTLS and **births the inventory record** on approve.
 - **Deployment:** `Dockerfile` + `docker-compose.yml` (private InfluxDB +
-  host-networked manager) + `server-pki.sh` + `DEPLOY.md`.
+  host-networked manager) + `server-pki.sh` + admin-UI cert `acme` side-car (LE
+  DNS-01 via Route 53, auto-renew) + CI image build (`fleet-manager-image.yaml`,
+  pulled by tag) + `backup.sh` (durable volumes) + `DEPLOY.md`.
+- **Hardening still open (operator/per-env):** network-segment the admin (`:9500`)
+  + agent (`:9600`) listeners to the mgmt net; run `server-pki.sh` when the agent
+  lands; decide `:9500` vs a 443 proxy; digest-pin the images (invariant #12). See
+  DEPLOY.md "Hardening status".
 - **STILL TO BUILD:** (a) the **on-host agent** — the gRPC report/reconcile client
   that pairs with `fleet-hostapi` (feeds this plane; nothing on the host talks to
   the manager yet); (b) **per-host boot-version assignment** — `target_version` is