docs: reflect chrony/uptime metrics, agent-cert renewer, and the chrony-access findings

Recent work added telemetry fields and a cert path not yet in the docs:
- files/agent/README.md: add uptime to the health list; document that chrony is
  read from /var/log/chrony/tracking.log (not the command socket) and needs BOTH
  the chrony supplementary group (DAC) and the fleet_agent_chronylog SELinux allow
  (TE), plus a reachable lab NTP (123/udp firewall); note the chrony group on the
  unit row.
- serving/fleet-manager/README.md: add uptime + chrony detail to the health list;
  note the cert-auto agent-cert-renewer sidecar + GetCertificate hot-reload
  (certreload.go) in the bring-up and checkpoint 7.
- docs/TODO.md #14: probe list gains uptime + chrony-from-tracking.log; new dated
  block records uptime/reboot-pending, the 4-layer chrony-access chase (all
  silent-failing; inventory.json is the isolator), and the agent-plane cert
  auto-renewal, all bench-verified 2026-07-10.
- docs/fleet-management-design.md: health record gains uptime + chrony
  source/stratum/offset detail.

serving/fleet-manager/README.md

@@ -69,7 +69,7 @@ Host (cert_serial)
   ├─ binding  : asset_tag, switch_port, location        (recorded at approval)
   ├─ enrolled : approver, at, fingerprint
   ├─ version  : image_version, rootfs_digest, kernel     (agent-reported)
-  ├─ health   : load, cpu, temp, tmpfs%, nvme_root, auth, selinux, chrony, kiosk  (latest snapshot; series in InfluxDB)
+  ├─ health   : load, cpu, temp, tmpfs%, uptime, nvme_root, auth, selinux, chrony (state+source/stratum/offset), kiosk  (latest snapshot; series in InfluxDB)
   ├─ usage    : kiosk_url, session_uptime, chromium_crashes, display
   └─ desired  : target_version, kiosk_url, reboot_at, drain   (SERVER-AUTHORITATIVE)
 ```
@@ -141,7 +141,9 @@ inventory for offline delivery. Metrics writing is behind a `MetricsSink`
 Full bring-up (PKI, Let's Encrypt DNS-01, `register-admin`, compose) is in
 [`DEPLOY.md`](DEPLOY.md). Config is layered: **`defaults.env`** (committed) +
 **`.env`** (overrides/secrets), via `COMPOSE_ENV_FILES=defaults.env,.env`. In
-short: set that + write your secrets to `.env` → `./server-pki.sh` +
+short: set that + write your secrets to `.env` → `./server-pki.sh` (or, where
+step-ca is co-located, the `cert-auto` **`agent-cert-renewer`** sidecar that
+issues + auto-renews the agent-plane server cert and hot-reloads it — DEPLOY §2a) +
 `../enrol-broker/admin-pki.sh … fleet-manager` → `docker compose up -d influxdb`
 → `docker compose run --rm fleet-manager register-admin <you>` → `docker compose
 up -d fleet-manager traefik`. InfluxDB is private (published to loopback only);
@@ -187,9 +189,11 @@ curl -s localhost:9500/api/hosts | jq '.hosts[] | {name:.identity.starship_name,
 - **Checkpoint 7 (done):** deployment — three-stage `Dockerfile` (npm→dist→
   `go build -tags embedspa`→distroless), `docker-compose.yml` (private InfluxDB +
   host-networked manager), `defaults.env`, `server-pki.sh` (agent-plane fleet-CA
-  server cert), and [`DEPLOY.md`](DEPLOY.md) (PKI, LE DNS-01, `register-admin`
-  bootstrap). Design docs updated (manager marked built; resolved transport/auth/
-  metrics forks; per-host-versioning gap recorded).
+  server cert) **+ the `cert-auto` `agent-cert-renewer` sidecar** (auto-issues +
+  auto-renews that cert from a co-located step-ca; the manager hot-reloads it via
+  `GetCertificate` in `certreload.go` — no restart), and [`DEPLOY.md`](DEPLOY.md)
+  (PKI, LE DNS-01, `register-admin` bootstrap). Design docs updated (manager marked
+  built; resolved transport/auth/metrics forks; per-host-versioning gap recorded).
 - **Checkpoint 8 (done):** hardening + ingress — CI image build
   (`fleet-manager-image.yaml`, pulled by tag), `backup.sh`; a **behind-proxy admin
   mode** (passkey over plaintext behind a TLS-terminating proxy) fronted by a