R-50 SHIPPED: fleet migrated to the island; Phase 5 docs

- B2 demo-hp + B3 demo-felhom migrated to the island (agent 0.96.0), apps
  served throughout (0 container restarts), island /storage 200, LAN DNS pinned
  to the LAN IP, hub reports 0.96.0. No rollback.
- capability-map 'site/network change' row PARTIAL -> PROVEN-LIVE
- ROADMAP R-50 -> SHIPPED (fleet-migrated); add R-74 (island on Peti's cluster)
- nodes.md: both boxes island-bound, agent 0.96.0

REPORT.md

@@ -38,6 +38,14 @@ plane. This is the one hard ordering constraint.
     manual edits**) → the provisioning path is proven live (spike method caveat CLOSED). F1 replay + cold
     reboot were proven on the same drill (spike P6/P7). *(A literal ISO wipe-reinstall was not run — the
     surgical provision proves the R-50-specific behavior; the ISO/first-boot/day-0 glue is unchanged.)*
-  - **B2 demo-hp / B3 demo-felhom:** await your go/no-go (each its own STOP). The runbook + rollback table
-    are ready; apps stay up throughout.
-- **Phase C (Peti cluster): parked** — its own supervised runbook + a new ROADMAP row (to add at Phase 5).
+  - **B2 demo-hp — DONE (2026-07-25).** Agent 0.95.0→0.96.0, vmbr9, guest 9201 net1, island bind, DNS pinned
+    to `.87`. Verify: island `/storage` **200**, LAN DNS OK, **7/7 apps unchanged** (cloudflared/traefik uptime
+    42h = never restarted), public URL **302**, hub reports 0.96.0. No rollback.
+  - **B3 demo-felhom — DONE (2026-07-25).** Same procedure; DNS pinned to `.162`. Verify: island `/storage`
+    **200**, LAN DNS OK, **15/15 apps unchanged**, public URL **302**, hub reports 0.96.0. No rollback.
+  - Both boxes' `.bak-0.95.0` agent + `/etc/network/interfaces.pre-island.bak` retained for rollback.
+- **Phase 5 (closing docs): DONE.** Capability-map "site/network change" row → **PROVEN-LIVE**; ROADMAP R-50 →
+  **SHIPPED (fleet-migrated)**; **R-74** added (island on Peti's cluster); nodes.md updated (both boxes island,
+  agent 0.96.0). **Firewall (runbook §8):** on both boxes the island bind already moved the listener off the
+  LAN (nothing on `<LAN>:8443`) — the LAN surface is closed by the bind; the portless-bridge narrowing is moot.
+- **Phase C (Peti cluster): parked as R-74** — its own supervised runbook (SDN/bridge parity), coordinated with Peti.