docs: record companion/fips subdomains in VPS2 migration task

.planning/todos/pending/2026-07-30-migrate-source-references-to-https-domain.md

@@ -47,5 +47,8 @@ Execute as a dedicated quick task IMMEDIATELY AFTER phase 2's 02-08 (don't distu
 2. **Image-ref transition safety:** running containers/quadlets store the OLD image name; migration must not orphan or re-pull-break existing apps (migrations never destroy data). Plan the transition: catalog+manifests flip, orchestrator treats old/new registry names as equivalent during adoption, or staged re-tag.
 3. Rebuild core, run the lifecycle gate on a dev node (NOT the fleet), verify: self-update fetch, catalog fetch, image pull via domain, app install end-to-end.
 4. Keep the IP endpoints alive on VPS2 during transition — nodes updating FROM old releases still hit IP URLs (fallback window until fleet rolls past).
-5. `:2100` + `:8444`: needs Dorian's VPS2-side config (openresty route for packages; DNS/cert decision for the anchor). Blocked-on-user items, tracked here.
+5. `:2100` + `:8444`: Dorian is setting these up (2026-07-30) as:
+   - `companion.archipelago-foundation.org` → replaces `http://146.59.87.168:2100` (companion APK downloads; update `CompanionIntroOverlay.vue` + any packaging docs). HTTPS assumed — verify before flipping.
+   - `fips.archipelago-foundation.org` → replaces the raw IP in `ARCHY_ANCHOR_ADDR` (`fips/anchors.rs`), becoming `fips.archipelago-foundation.org:8444` (or whatever port Dorian lands on). SECURITY-SENSITIVE: check whether the FIPS anchor validation pins certificates/identity to the address before changing; verify anchor handshake against the new name from a dev node before fleet rollout.
+   - As of 2026-07-30 22:50 UTC neither subdomain resolved yet — re-verify DNS + TLS at execution time; do not flip these two refs until both probes pass.
 6. Remove insecure-registry config from node provisioning once pulls verify over TLS.