docs: record the DNS cutover as complete; flag the old box as an unresolved internet exposure

- Migration addendum: replace the 'DNS split' wording with the verified state —
  every hostname resolves to the new box (A+AAAA) per Cloudflare's public
  resolver; nothing points at the old box.
- Reframe the old box: not a benign rollback spare but a decommissioned server
  still alive and internet-exposed (22/80/443/587/993 open), holding old data and
  config, serving no member traffic. UNRESOLVED — operator decision to shut it
  down or firewall it. Do not act on it without the operator's word.
- README: add a 'Known open items' section listing the exposure, the CI failure,
  the unpushed CI-agent repo and the unconfirmed member mailbox contents.

README.md

@@ -56,6 +56,21 @@ answers proves nothing about whether a record exists. At least two listed
 records turned out not to exist, and the real record inventory is only visible
 in the registrar's own list.
 
+## Known open items — recorded, not hidden
+
+These are genuinely unresolved; a tidy document that omits them would be wrong.
+
+- **The old box `179.199.135.72` is still alive and internet-exposed** (22/80/443/587/993
+  open), holding old data and config. Nothing in DNS points at it, so it serves no
+  member traffic — but it needs an operator decision: **shut it down or firewall it**.
+  Do not act on it without the operator's word. See `migration/cloudron-server-migration.md` (addendum).
+- **CI is not green.** The Woodpecker agent is healthy but the server answers its
+  job-collection stream with HTTP 500, so no pipeline can run. See `maintenance/woodpecker-ci.md`.
+- **The CI agent image source (`/home/ubuntu/repos/woodpecker-agent`) has no git
+  remote** — it exists only on the agent host.
+- **Member mailbox contents after the migration** are still unconfirmed (needs a
+  real IMAP login).
+
 ## No secrets here
 
 Audited 2026-11-01, including the full commit history: no credentials, tokens,