ROADMAP.md: mark Stage 1's kind e2e pass done, with what it found

ROADMAP.md

@@ -89,12 +89,19 @@ New commits build forward over the old ones; no git history rewrite.
   `/api/bootstrap` and `/api/service-accounts` (§11), including the
   adopt-on-409 recovery path and the one fail-closed case
   (`BootstrapStateLost`), not just the happy path.
-- A real `kind` end-to-end pass is still open (bring-your-own DSN is
+- **Done, 2026-10-01**: a real `kind` end-to-end pass (bring-your-own DSN,
-  simplest there) to prove a `TerdutServer` CR actually produces a running,
+  real terdut-server `v0.33.0` image, operator built into a real image and
-  bootstrapped terdut-server pod against a real cluster, not just envtest's
+  deployed as a real Pod, not `go run` against the cluster). `TerdutServer`
-  fake API server. The Zalando path can additionally be validated for real
+  went `Ready`; the generated credential authenticated and exercised its
-  against the org's own cluster later, where `postgres-operator` already
+  real capability against the actual server
-  runs, rather than only in a disposable `kind` stand-in.
+  (`GET`/`POST /api/teams` → `200`/`201`, confirmed from terdut-server's own
+  access log). Caught two real bugs no `envtest` suite could have (its
+  client bypasses RBAC): `.dockerignore`'s `!**/*.go` not working under
+  podman, and missing RBAC for `events.k8s.io` (the new events API
+  `GetEventRecorder` uses) — both fixed. The Zalando path can additionally
+  be validated for real against the org's own cluster later, where
+  `postgres-operator` already runs, rather than only in a disposable `kind`
+  stand-in — not done in this pass.
 
 ## Stage 2 — `TerdutTeam`