Lock down chromium policy

docs/TODO.md

@@ -155,6 +155,15 @@ Path to getting here (don't re-discover):
   avc`; the kiosk user is unconfined so likely none — but do NOT set permissive
   if they appear; add a policy module). Admin SSH (the key user) still works for
   debug even if the kiosk fails (it lands at graphical.target either way).
+- **Phone-home lockdown (done 2026-06-17):** Chromium was dialing Google
+  (accounts/variations/optimization-guide/component+auto update/safe browsing —
+  seen in dnsmasq logs). Stopped via a managed policy
+  (`files/kiosk/chromium-kiosk-policy.json` → `/etc/chromium/policies/managed/`)
+  plus hardening flags in `kiosk-session` (`--disable-background-networking`,
+  `--disable-component-update`, `--disable-features=OptimizationHints,...`, etc.).
+  Verify with the dnsmasq query log after a rebuild — only `boot.fleet.lab`
+  (kiosk page) + chrony NTP should remain. NTP is the OS (chrony), not Chromium;
+  optionally point it at the serving host to fully contain egress.
 - **Image size:** Chromium+Mesa add hundreds of MB to the *uncompressed* erofs —
   feeds the "shrink the rootfs" concern (and #7); reconsider whether a lighter
   browser/render path is viable.