docs/roadmap.md still says smaug is unconfigured and its firewall rules unwritten #486

c938c37 — "smaug is placed, addressed and reachable on named ports" — edited
README.md, docs/architecture.md, docs/hardware.md, docs/network.md,
docs/security.md and docs/runbooks/build-the-nas.md. It did not edit
docs/roadmap.md, and neither did the three PRs before it.

So the roadmap's #95 paragraph still describes a box in a van.
docs/roadmap.md:711
and :720:

what the build waits on is those and a bench, not money.

Nothing is configured.

Both were true when written on 2026-09-15. Since 2026-09-16 the BIOS is flashed,
AMT is unprovisioned and disabled, the boot disk is fitted and SMART-baselined,
TrueNAS 25.10 is installed, the static and the Kea reservation are set, and four
inbound passes are created and verified in position. docs/architecture.md:193
already carries the sentence the roadmap should agree with:

The host is built and the pool is not.

Why this is worth an issue rather than a silent fix

The same paragraph also still says "50→40 is not a rule to add" and
describes ADR-0016's rules as written-down-but-uncreated. Those passes exist.
Anyone reading the roadmap for the shape of the remaining work — which is what
that file is explicitly for — would conclude the firewall work is ahead of them
when it is behind them.

The roadmap's own header says the tracking lives in Issues and "this file is
the shape of the work", and warns that "two places holding the same checkbox
is how a checkbox stops being true — and this file has already been wrong about
the switch answering SNMP and about the history purge." This is that a third
time.

What it needs

• Update the #95 paragraph: the build is past §0, and what remains is the
  two Exos drives and everything downstream of them.
• Correct the firewall sentences — four passes exist, Hicks reaches 443
  rather than the 22 ADR-0016's table names, and the port-22 rule that
  does exist is inert because TrueNAS ships SSH disabled.
• Re-read the PBS paragraph at :823, which says smaug is "bought … and
  not built" and moves the trigger from a purchase to a build. The trigger
  has fired; see the PBS issue filed alongside this one.
• Check the rest of the file for the same drift while in there — the
  "Already paid for and still moving" list is correct as of today, but the
  Exos drives are the only smaug row left on it.

Found reconciling the tracker against the smaug build
(#413).