docs: architecture Part 06 — offsite-connectivity design-of-record (slice roadmap S1-S6)

Records the settled transport decisions (plain WG, host-side agent-managed pilot,
one hub-driven endpoint VM running WG+PBS, hub source-of-truth over WireDesiredState,
one datastore + per-customer namespaces, relay-through-DooPlex rejected). Grounded
at file:line vs felhom.eu@bf099f6 + felhom-agent@4ba1b14. Backlog line resolved to
cite spike + design doc. Docs-only; slices are separate future tasks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

documentation/runbooks/day0-install.md

@@ -119,11 +119,12 @@ Notes:
   Felhom-pool guests — other guests on a shared box are invisible there. Always pick from
   `pct list` + `qm list` on the box (`documentation/runbooks/provisioning.md`).
 - Offsite backup (`felhom-pbs`) is NOT part of a go-live today: the PBS host is LAN-only. The
-  transport decision is now MADE — plain WireGuard, host-side, box-dials-out to a small public
-  endpoint (spike-proven: `documentation/audits/SPIKE-connectivity-wireguard-2026-07-03.md`);
-  what remains is the production connectivity spec + endpoint VM. Go-live standard = **local
-  backups only** (that is what the Part C command configures); offsite DR is retrofitted later
-  via `--rescope-acl` / `--acl-storages` without reinstalling.
+  transport is DECIDED and DESIGNED — plain WireGuard, host-side agent-managed, box-dials-out to
+  a public endpoint VM running the offsite PBS. Evidence:
+  `documentation/audits/SPIKE-connectivity-wireguard-2026-07-03.md`; design-of-record + slice
+  roadmap: `documentation/architecture/06-offsite-connectivity.md` (MVP = slices S1→S2→S3, then
+  S4). Go-live standard = **local backups only** (that is what the Part C command configures);
+  offsite DR is retrofitted later via `--rescope-acl` / `--acl-storages` without reinstalling.
 
 ---