split out hash because rocky doesnt support it inline

docs/TODO.md

@@ -173,6 +173,18 @@ boot LAN.
     `/etc/udev/rules.d/95-nvmf-initqueue.rules`) — so the fully-native
     `rd.nvmf.discover` autoconnect path is available as a fallback if the unit
     doesn't fire on boot.
+  - **dm-verity: `hash-offset` is unsupported → two namespaces.** With NVMe
+    connecting and the right by-id device present, verity still failed:
+    `systemd-veritysetup` logged `unknown option 'hash-offset=…'` then `Failed
+    to load verity superblock` — exactly the CLAUDE.md bench-verify item. The
+    in-file (data+hash in one namespace, split by offset) layout is not
+    supported by Rocky 9.8 systemd. **Fixed** via the documented fallback:
+    `extract-artifacts.sh` now emits `rootfs.erofs` (data) + `rootfs.hash` (hash
+    tree) as separate files, served as **two NVMe namespaces** with distinct
+    pinned UUIDs (`f1ee7000-…-01` data, `…-02` hash); the cmdline uses
+    `systemd.verity_root_data=`/`systemd.verity_root_hash=` by-id devices with no
+    offset. Touches `extract-artifacts.sh`, `build-oci.sh` (artifact list +
+    SHA256SUMS), `serving/spdk-setup.sh` (2nd bdev/namespace), and invariant #9.
     **⚠ The secure path has the same dependency on the
     (absent) nvmf autoconnect** — when 802.1X is re-enabled, the macsec0 path
     must likewise drive `connect-all` (or the network-manager port #1 must wire