docs: reflect chrony/uptime metrics, agent-cert renewer, and the chrony-access findings

Recent work added telemetry fields and a cert path not yet in the docs:
- files/agent/README.md: add uptime to the health list; document that chrony is
  read from /var/log/chrony/tracking.log (not the command socket) and needs BOTH
  the chrony supplementary group (DAC) and the fleet_agent_chronylog SELinux allow
  (TE), plus a reachable lab NTP (123/udp firewall); note the chrony group on the
  unit row.
- serving/fleet-manager/README.md: add uptime + chrony detail to the health list;
  note the cert-auto agent-cert-renewer sidecar + GetCertificate hot-reload
  (certreload.go) in the bring-up and checkpoint 7.
- docs/TODO.md #14: probe list gains uptime + chrony-from-tracking.log; new dated
  block records uptime/reboot-pending, the 4-layer chrony-access chase (all
  silent-failing; inventory.json is the isolator), and the agent-plane cert
  auto-renewal, all bench-verified 2026-07-10.
- docs/fleet-management-design.md: health record gains uptime + chrony
  source/stratum/offset detail.

docs/fleet-management-design.md

@@ -125,8 +125,9 @@ Reported facts:
 
 - **Health:** CPU/load, GPU act-freq, temps, **tmpfs overlay usage** (the
   RAM-exhaustion → NVMe-keepalive risk — the single most important kiosk health
-  signal), NVMe-root link state, 802.1X/MACsec `Authorized`, SELinux enforcing,
-  chrony sync, `kiosk.service` active.
+  signal), host **uptime** (server derives reboot-pending vs `reboot_at`),
+  NVMe-root link state, 802.1X/MACsec `Authorized`, SELinux enforcing, chrony
+  clock health (sync state + NTP source/stratum/offset), `kiosk.service` active.
 - **Version:** running image version (`/etc/fleet-image`), rootfs digest, kernel.
 - **Usage:** kiosk URL, session uptime, **Chromium reload/crash count** (from the
   `kiosk-session` restart loop — the exact signal behind the GPU-bug diagnosis),
@@ -186,8 +187,9 @@ UKI).
 Host (by cert-serial / hostnqn)
   ├─ identity:   cert serial, hostnqn, MAC, starship-name (dnsmasq)
   ├─ version:    image_version, rootfs digest, kernel, desired_version
-  ├─ health:     cpu/load, gpu_freq, temps, tmpfs_used%, nvme_root, auth/macsec,
-  │              selinux, chrony, kiosk_active, last_seen
+  ├─ health:     cpu/load, gpu_freq, temps, tmpfs_used%, uptime, nvme_root,
+  │              auth/macsec, selinux, chrony (sync + source/stratum/offset),
+  │              kiosk_active, last_seen
   ├─ usage:      kiosk_url, session_uptime, chromium_crashes, input_active, display
   └─ desired:    target_version, kiosk_url, reboot_at, drain   (server-authoritative)
 ```