docs(tracker): tick §F per-device secrets + ISO checksums (caf9e6d3)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/1.8.0-RELEASE-HARDENING-PLAN.md

@@ -295,15 +295,22 @@ media (latest artifact only one minor behind).
       so alpha/beta testers get frictionless AI (deliberate — per user 2026-07-02). **Do NOT
       remove for alpha/beta.** Before public GA it MUST be removed + rotated + injected at runtime
       (a second copy also exists in a worktree). Track it here so it can't be forgotten at launch.
-- [ ] 🔴 **Per-device secrets on first boot.** The self-signed TLS **private key is generated
+- [x] 🔴 **Per-device secrets on first boot.** DONE 2026-07-13 (`caf9e6d3`):
-      at build time** (`:426`) → every device ships the same key; SSH host keys likewise not
+      `archipelago-first-boot-secrets.service` (enabled on the installed target, ordered
-      regenerated. Generate TLS + SSH host keys on first boot.
+      Before=ssh/nginx/archipelago, marker-guarded) regenerates the self-signed TLS keypair
+      with the device hostname in the SAN and all SSH host keys via staging-first swap —
+      a failed regeneration keeps the baked keys instead of leaving the device keyless.
+      **Unverified on hardware**: needs one RC-ISO install to confirm the service fires
+      and sshd/nginx pick up the new keys.
 - [ ] 🟠 **Kill default credentials.** `archipelago`/`archipelago` (SSH+root), web `password123`,
       and SSH `PasswordAuthentication yes` (`:411`) all ship. Lock root, force credential
       creation in onboarding, disable SSH password auth (or force-change on first login).
-- [ ] 🟠 **Sign + checksum the ISO.** Pipeline ends at `xorriso` with no `SHA256SUMS`, no
+- [~] 🟠 **Sign + checksum the ISO.** Checksums DONE 2026-07-13 (`caf9e6d3`): the builder
-      GPG/minisign, no Secure Boot (`BOOTX64.EFI` is unsigned though `grub-efi-amd64-signed` is
+      emits `<iso>.sha256` after xorriso, and `scripts/sign-iso-checksums.sh` signs
-      installed). Emit + sign checksums; wire signed Secure Boot.
+      `{artifact, sha256, size}` as a JSON doc with the release-root ceremony (verify with
+      `archipelago ceremony verify` against the pinned anchor; build host never holds the
+      key). **Still open:** Secure Boot — `BOOTX64.EFI` is unsigned though
+      `grub-efi-amd64-signed` is installed.
 - [ ] 🟠 **Registries over HTTPS in the image too** — `146.59.87.168:3000`
       are baked `insecure=true`/`tls_verify:false` (`:216`, `:2308`). (Ties to §A.)
 - [ ] 🟡 **Add `unattended-upgrades` + a default-deny nftables firewall** (allow 22/80/443 +
@@ -404,8 +411,7 @@ media (latest artifact only one minor behind).
 6. **Before public GA only (NOT alpha/beta):** remove + rotate the Anthropic key (§F) —
    intentionally left in for frictionless AI during alpha/beta.
 
-*Last updated: 2026-07-08 PM (hardening session 3: §C secrets verified on .228,
+*Last updated: 2026-07-13 (hardening session 4: §F per-device first-boot
-§B release-path guards `e77ccff0`, §H test creds/timeouts `380f4f19`, mempool
+secrets + ISO checksum emission/ceremony signing `caf9e6d3` — both need one
-umbrella lifecycle fix `161a6e4d` from the first quadlet-mode gate run; new
+RC-ISO install to verify on hardware; Secure Boot remains the open half of
-finding: manifests hardcoding secrets in plain `environment:`). Update this
+ISO signing). Update this line + tick boxes with commit shas as items land.*
-line + tick boxes with commit shas as items land.*