docs: reflect chrony/uptime metrics, agent-cert renewer, and the chrony-access findings

Recent work added telemetry fields and a cert path not yet in the docs:
- files/agent/README.md: add uptime to the health list; document that chrony is
  read from /var/log/chrony/tracking.log (not the command socket) and needs BOTH
  the chrony supplementary group (DAC) and the fleet_agent_chronylog SELinux allow
  (TE), plus a reachable lab NTP (123/udp firewall); note the chrony group on the
  unit row.
- serving/fleet-manager/README.md: add uptime + chrony detail to the health list;
  note the cert-auto agent-cert-renewer sidecar + GetCertificate hot-reload
  (certreload.go) in the bring-up and checkpoint 7.
- docs/TODO.md #14: probe list gains uptime + chrony-from-tracking.log; new dated
  block records uptime/reboot-pending, the 4-layer chrony-access chase (all
  silent-failing; inventory.json is the isolator), and the agent-plane cert
  auto-renewal, all bench-verified 2026-07-10.
- docs/fleet-management-design.md: health record gains uptime + chrony
  source/stratum/offset detail.

files/agent/README.md

@@ -22,9 +22,12 @@ build VM** by CI (deps proxy-fetched, `go.sum`-pinned) and file-provisioned in.
 3. **Sends `Hello`** (image version, kernel, kiosk URL, root hash, starship name —
    the fleet-generic facts, pulled from `fleet-hostapi` on `127.0.0.1:9099`).
 4. **Sends a `HealthSnapshot` every `FLEET_AGENT_INTERVAL`** — load/cpu/temp/mem/
-   tmpfs, nvme-root, 802.1X-macsec, selinux, chrony, kiosk-active — probed
-   read-only from `/proc`+`/sys` (each probe degrades gracefully; a failure never
-   kills the stream).
+   tmpfs, **uptime**, nvme-root, 802.1X-macsec, selinux, kiosk-active — probed
+   read-only from `/proc`+`/sys`, plus **chrony** clock health (sync state +
+   source/stratum/offset relative to the NTP source; see note). Each probe
+   degrades gracefully; a failure never kills the stream. `uptime` lets the
+   manager derive **reboot-pending** (boot_time = last_seen − uptime vs the
+   requested `reboot_at`, all in the manager's clock frame).
 5. **Receives `DesiredState`/`Command` and LOGS them.** This build does **not**
    act on them. The reconcile actuators (apply kiosk URL, reboot, drain) are a
    deliberate follow-up (see `docs/TODO.md` #14) — the receive path is wired now so
@@ -33,6 +36,17 @@ build VM** by CI (deps proxy-fetched, `go.sum`-pinned) and file-provisioned in.
 A dropped stream is retried with jittered backoff; the manager treats stream loss
 as the host going **offline**.
 
+> **Note — the chrony probe reads a file, not the command socket.** chronyd's unix
+> command socket is owner-write-only and STIG sets `cmdport 0` (no UDP command
+> port), so the sandboxed agent can't query it. Instead the image enables
+> `log tracking`, and the agent reads the last line of
+> `/var/log/chrony/tracking.log`. That read needs **two** access layers, both wired
+> in: the **`chrony` supplementary group** (DAC — `/var/log/chrony` is `0750`) and
+> a minimal **SELinux allow** for the `chronyd_var_log_t` label
+> (`files/stig/fleet-agent-chronylog.te`). The lab NTP server must also be
+> reachable (a `123/udp` host-firewall rule on the serving host) or the log only
+> carries `unsynced` lines. See `docs/stig-deviations.md` #16.
+
 ## Prerequisite: the host must already be enrolled
 
 The manager rejects the stream (`PermissionDenied`) until an inventory record
@@ -56,7 +70,7 @@ identity, mirror `rd.dot1x.*`), `FLEET_AGENT_INTERVAL`, `FLEET_AGENT_HOSTAPI`.
 | `snapshot.go` | read-only `/proc`+`/sys` health probes + hostapi facts fetch |
 | `tpmkey/` | **copy** of `files/enrol/tpmkey` + read-only `LoadSigner` (see its header) |
 | `proto/` | **copy** of the generated `fleet.agent.v1` package (one `.proto` contract, two peers) |
-| `fleet-agent.service` | hardened unit (tss group for the TPM, INET egress) |
+| `fleet-agent.service` | hardened unit (`tss` group for the TPM, `chrony` group to read chrony's tracking.log, INET egress) |
 
 ## Build / test