Update Documents to latest implementation

CLAUDE.md

@@ -19,6 +19,8 @@ files/etc/dracut.conf.d/90-diskless.conf  no-hostonly + drivers + modules
 files/etc/NetworkManager/                 NM unmanaged-device config
 scripts/extract-artifacts.sh              qcow2 -> kernel/initramfs/erofs+verity/cmdline
 scripts/build-oci.sh                      ukify + sbsign + roothash gate + OCI image
+serving/                                  Lab serving stack: dnsmasq + nginx + SPDK
+.gitea/workflows/                         Gitea CI: lint -> packer build -> push OCI
 docs/                                     Design PDF and supporting notes
 ```
 
@@ -30,8 +32,11 @@ packer validate .                         # always before committing template ch
 packer build -var image_version=X.Y.Z \
   -var nic_drivers="ice mlx5_core" \
   -var oci_image=<registry>/fleet-boot .  # add sb_key/sb_cert for signed builds
+                                          # add disable_dot1x=true for an
+                                          # open-port test UKI (rd.dot1x=0)
 bash -n files/dracut/95dot1x-macsec/*.sh scripts/*.sh   # shell syntax gate
-shellcheck files/dracut/95dot1x-macsec/*.sh scripts/*.sh
+# .shellcheckrc disables the dracut false positives; CI passes them explicitly:
+shellcheck --exclude=SC1091,SC2154 files/dracut/95dot1x-macsec/*.sh scripts/*.sh
 ```
 
 Build-host deps: qemu-kvm, libguestfs-tools, erofs-utils, cryptsetup, jq,
@@ -113,8 +118,40 @@ instead of working around it.
   journal-less ext4 in `extract-artifacts.sh`).
 - `systemd.verity_root_options=hash-offset` support in the shipped systemd
   (fallback: split data/hash into two namespaces).
-- `network-legacy` dracut module availability (the hook’s `ifup` step needs
-  porting if a future release drops it).
+- `network-legacy` dracut module needs `dhclient`; RHEL 9 omits it from the
+  minimal install, so the provisioner installs `dhcp-client` (without it dracut
+  fails "module network-legacy can't be installed"). dhclient is deprecated —
+  the durable fix is porting the hook to the `network-manager` dracut module.
+- Writable root overlay is `systemd.volatile=overlay`, **not** `rootovl`:
+  RHEL/Rocky dracut ships no `overlayfs`/`rootovl` module. Needs
+  `systemd-volatile-root.service` in the initramfs (bundled by recent dracut;
+  `install_items` it if the root stays read-only). Misbehaves with NFS root —
+  N/A here (NVMe block root).
+
+## RHEL 9.x build notes (learned — don't re-discover)
+
+These bit us bringing the build up on Rocky 9.8; they are easy to regress.
+
+- **ISO**: default is a version-pinned Rocky 9.x **minimal** ISO on the internal
+  mirror (`iso_url` + `sha256` in `iso_checksum`; bump both together on a point
+  release). `http/ks.cfg` installs only `@^minimal-environment`+sshd+chrony from
+  the ISO; the diskless tooling is pulled **online** by the provisioner, so the
+  build VM needs outbound repo access. Keeps the build ISO-variant-agnostic.
+- **`%{...}` in provisioner shell** (e.g. `rpm --qf '%{VERSION}'`) must be
+  escaped `%%{...}` — Packer's HCL2 engine parses a bare `%{` as a template
+  directive and `packer validate` fails otherwise.
+- **File provisioner staging**: pre-create the destination dir (`mkdir -p
+  /tmp/etc-stage`) before a trailing-slash *contents* upload; Packer requires
+  the dest to exist or the tree lands elsewhere and later `install` steps fail.
+- **dracut module name** in `add_dracutmodules` omits the `NN` dir-prefix: the
+  directory is `95dot1x-macsec` but the module is `dot1x-macsec` (cf. `nvmf`).
+- **`network-legacy` → `dhcp-client`** and **overlay → `systemd.volatile=overlay`**:
+  see the bench-verify items above.
+- **Test toggle**: `disable_dot1x=true` bakes `rd.dot1x=0`; the hook then skips
+  802.1X/MACsec and DHCPs the NIC directly for NVMe-oF on an open port. The auth
+  stack stays in the image, dormant. The matching lab DHCP/HTTP/NVMe-oF serving
+  stack lives in `serving/` (docker compose). Re-enable security by dropping the
+  var / setting `DISABLE_DOT1X: "false"` in the CI workflow.
 
 ## Testing changes