fleet-manager: document hardening status + remaining per-env items

DEPLOY.md gains a "Hardening status" section (done vs operator-to-close), and
TODO #14 records the deployment as CI-built + acme-cert + backup, with the open
items called out: network-segment the :9500/:9600 listeners to the mgmt net, run
server-pki.sh when the agent lands, choose :9500 vs a 443 proxy, and digest-pin
the images.

serving/fleet-manager/DEPLOY.md

@@ -260,6 +260,27 @@ If you run compose under a non-default project name, pass
   `server.crt`/`server.key`/`admin-ca.crt` exist in its PKI mount, and restart it
   (see step 2b).
 
+## Hardening status
+
+Done: distroless-nonroot runtime; passkey admin auth over HTTPS with an
+auto-renewing LE cert (`acme` side-car); mTLS on both the agent (fleet CA) and
+manager→broker (admin CA) planes; secrets kept server-side (`.env`/PKI gitignored);
+optional planes soft-disable instead of crash-looping; CI builds + pushes the
+image (`fleet-manager-image.yaml`); `backup.sh` for the durable volumes.
+
+Still open (operator to close per environment):
+- **Network segmentation.** The admin (`:9500`) and agent (`:9600`) listeners must
+  be reachable only from the **mgmt network** — never the boot LAN. Enforce with a
+  host firewall / security group; this repo can't.
+- **Agent-plane server cert.** `server-pki.sh` isn't run yet (nothing connects to
+  the agent plane until the on-host agent exists — it soft-disables meanwhile).
+  Issue it when the agent lands.
+- **Admin exposure.** Decide `:9500` direct vs a 443 mgmt proxy (TLS passthrough)
+  and align `FLEET_MGR_RP_ORIGIN` — see §2c.
+- **Digest pinning.** For a locked deployment, pin `fleet-manager`, `influxdb`,
+  and the `goacme/lego` images by `@sha256:…` (CLAUDE.md invariant #12) rather than
+  the tags used here for convenience.
+
 ## What is NOT yet wired (recorded intent)
 
 Per-host **boot-version assignment** (`desired.target_version`) is stored and