Add ntp time source and browser policy

docs/TODO.md

@@ -155,15 +155,32 @@ Path to getting here (don't re-discover):
   avc`; the kiosk user is unconfined so likely none — but do NOT set permissive
   if they appear; add a policy module). Admin SSH (the key user) still works for
   debug even if the kiosk fails (it lands at graphical.target either way).
-- **Phone-home lockdown (done 2026-06-17):** Chromium was dialing Google
+- **Phone-home lockdown (done 2026-06-17/18):** Chromium was dialing Google
   (accounts/variations/optimization-guide/component+auto update/safe browsing —
-  seen in dnsmasq logs). Stopped via a managed policy
-  (`files/kiosk/chromium-kiosk-policy.json` → `/etc/chromium/policies/managed/`)
-  plus hardening flags in `kiosk-session` (`--disable-background-networking`,
-  `--disable-component-update`, `--disable-features=OptimizationHints,...`, etc.).
-  Verify with the dnsmasq query log after a rebuild — only `boot.fleet.lab`
-  (kiosk page) + chrony NTP should remain. NTP is the OS (chrony), not Chromium;
-  optionally point it at the serving host to fully contain egress.
+  seen in dnsmasq logs). Two layers:
+  - **Flags** in `kiosk-session` (`--disable-background-networking`,
+    `--disable-component-update`, `--disable-features=OptimizationHints,...`) —
+    confirmed killing variations/optimization-guide/update queries.
+  - **Managed policy** `files/kiosk/chromium-kiosk-policy.json` for the
+    policy-governed bits (sign-in `accounts.google.com`, sync). FIX 2026-06-18:
+    the managed-policy dir differs by build, so it's installed to BOTH
+    `/etc/chromium/policies/managed/` AND `/etc/chromium-browser/policies/managed/`
+    (a policy in the wrong dir is silently ignored — the reason
+    `accounts.google.com`/`android.clients.google.com` persisted). Verify via
+    `chrome://policy` (Status: OK per entry).
+  - **Serving-side sinkhole** (defense-in-depth, `serving/docker-compose.yml`
+    dnsmasq `--address=/google.com|googleapis.com|gstatic.com/0.0.0.0`): the
+    kiosk is local-only, so block egress at the resolver. Stops the *leak*; the
+    query still logs (answered 0.0.0.0, not forwarded) — eliminating the query
+    is the browser policy's job. Production: do this at the boot-LAN firewall.
+  - **NTP egress closed (done 2026-06-18):** the `*.pool.ntp.org` lookups were
+    the OS (chrony), not Chromium. Now: a `chrony` NTP server in the serving
+    stack (`serving/chrony/`), dnsmasq hands it via **DHCP option 42**, and the
+    image's NM dispatcher (`files/etc/NetworkManager/dispatcher.d/10-chrony-dhcp-ntp`)
+    feeds it into chrony's `sourcedir /run/chrony-dhcp`; the baked public pool is
+    stripped from `/etc/chrony.conf`. Result: the workstation syncs time only
+    from the lab server — no external NTP egress. BENCH-VERIFY: on a booted host
+    `chronyc sources` shows the lab server (the DHCP one), not a public pool.
 - **Image size:** Chromium+Mesa add hundreds of MB to the *uncompressed* erofs —
   feeds the "shrink the rootfs" concern (and #7); reconsider whether a lighter
   browser/render path is viable.