docs: reflect chrony/uptime metrics, agent-cert renewer, and the chrony-access findings

Recent work added telemetry fields and a cert path not yet in the docs:
- files/agent/README.md: add uptime to the health list; document that chrony is
  read from /var/log/chrony/tracking.log (not the command socket) and needs BOTH
  the chrony supplementary group (DAC) and the fleet_agent_chronylog SELinux allow
  (TE), plus a reachable lab NTP (123/udp firewall); note the chrony group on the
  unit row.
- serving/fleet-manager/README.md: add uptime + chrony detail to the health list;
  note the cert-auto agent-cert-renewer sidecar + GetCertificate hot-reload
  (certreload.go) in the bring-up and checkpoint 7.
- docs/TODO.md #14: probe list gains uptime + chrony-from-tracking.log; new dated
  block records uptime/reboot-pending, the 4-layer chrony-access chase (all
  silent-failing; inventory.json is the isolator), and the agent-plane cert
  auto-renewal, all bench-verified 2026-07-10.
- docs/fleet-management-design.md: health record gains uptime + chrony
  source/stratum/offset detail.

docs/TODO.md

@@ -1412,8 +1412,9 @@ the design forks resolved:
   the host **TPM identity** for mTLS (signing key at `0x81000100` via
   `tpmkey.LoadSigner` — a read-only copy of the enrol `tpmkey`; cert from NV
   `0x01800100`), opens the long-lived `Session` stream, sends `Hello` + periodic
-  `HealthSnapshot` (load/cpu/temp/mem/tmpfs/nvme/auth/selinux/chrony/kiosk probed
-  read-only from `/proc`+`/sys` + hostapi facts), and — **telemetry-only v1** —
+  `HealthSnapshot` (load/cpu/temp/mem/tmpfs/**uptime**/nvme/auth/selinux/kiosk from
+  `/proc`+`/sys` + hostapi facts, plus **chrony** clock health — state/source/
+  stratum/offset — read from `/var/log/chrony/tracking.log`), and — **telemetry-only v1** —
   **receives `DesiredState`/`Command` but only LOGS them** (zero host mutation).
   Static `CGO_ENABLED=0` binary built out-of-VM in CI (like enrol/hostapi), staged
   by the `2b-agent` provisioner (`enable_agent`, default on), fapolicyd-trusted,
@@ -1464,6 +1465,32 @@ the design forks resolved:
      register-host <serial> -name <starship>` (writes through the real store to
      `FLEET_MGR_INVENTORY`). The manager caches inventory in memory — any edit needs
      a `--force-recreate`. Also: the agent now logs the real gRPC status, not `EOF`.
+
+  **Metrics + cert auto-renewal added 2026-07-10 (`fleet-manager` branch):**
+  - **uptime + reboot-pending**: the agent sends `uptime_seconds`; the manager/UI
+    derive "reboot pending in X / rebooted" from boot_time (= last_seen − uptime) vs
+    `reboot_at`, all in the manager clock frame (no host↔manager clock sync needed).
+    Monitor metric graphs auto-refresh (10 s poll).
+  - **chrony clock health** (sync state + NTP source/stratum/offset). The agent reads
+    `/var/log/chrony/tracking.log` (image bakes `log tracking`), NOT chronyd's command
+    socket (owner-write-only unix socket; STIG `cmdport 0` closes the UDP port).
+    **Reaching that log from the hardened DynamicUser agent took a 4-layer chase, every
+    layer silent-failing** (memory `fleet-agent-hardened-probe-access`): (i) lab NTP
+    reachable — a `123/udp` rule on the serving-host firewall (host-networked ntp
+    container; same trap as audit `514`); (ii) DAC — `chrony` supplementary group on the
+    unit to traverse `/var/log/chrony` (0750); (iii) SELinux TE —
+    `files/stig/fleet-agent-chronylog.te` allow for `chronyd_var_log_t` (permissive
+    masks this); (iv) the MANAGER image must be ≥ the chrony commit — one with
+    uptime-but-not-chrony silently drops the fields (manager & workstation are SEPARATE
+    images/deploys). Isolator: read the manager `inventory.json` off the `fleet-data`
+    volume via a throwaway busybox (distroless manager, no shell). BENCH-VERIFIED on
+    `comet-beacon-54` 2026-07-10.
+  - **agent-plane server-cert auto-renewal**: the `agent-cert-renewer` compose sidecar
+    (profile `cert-auto`) issues + `step ca renew --daemon` renews the cert from a
+    co-located step-ca; the manager hot-reloads via `GetCertificate` (`certreload.go`),
+    no restart. Replaces the manual `server-pki.sh` + `docker exec … step` dance and
+    the 90-day re-mint. The server cert SANs MUST include `manager.fleet.lab` (the
+    fleet-DNS name the agent dials) — a missing SAN fails the handshake.
 - **STILL TO BUILD:** (b) **per-host boot-version assignment** — `target_version` is
   stored + pushed but does not change what a host *boots*; that needs dnsmasq
   cohort steering + multi-version UKI serving (**#6**). Kiosk URL / reboot / drain