Add SPDDK build

docs/TODO.md

@@ -98,3 +98,18 @@ is the tmpfs overlay), fleet-generic (no per-host state).
   browser are STIG findings and enlarge the attack surface/image. Reconcile —
   e.g. a tightly-constrained kiosk session + documented deviation — when
   hardening lands.
+
+## [~] 5. Deploy & validate the end-to-end boot path (open-network test)
+
+In progress. Stand up `serving/` (dnsmasq + nginx + SPDK) per
+[serving/README.md](../serving/README.md), rebuild the UKI with
+`nvmet_traddr=nvme.fleet.lab` (now a Packer var — older UKIs have the literal
+`NVMET_TRADDR` placeholder and won't connect), then boot a UEFI HTTP-boot client
+(**Secure Boot OFF**, unsigned UKI; no TPM needed in `rd.dot1x=0` mode) on the
+boot LAN.
+
+- **Pass criteria:** UKI fetched over HTTP → initramfs → DHCP on NIC → NVMe/TCP
+  namespace connected → dm-verity root mapped → `systemd.volatile=overlay`
+  writable → multi-user.
+- This validation **gates** item #1 (network-manager port) and item #3
+  (errata → design v3).