docs: record that v1.1.0 is tagged — release 1 is finished

The Roadmap said in two places that the tag was the only step left and that
it belonged to the operator. The operator authorised it and the lead cut it,
so both lines were about to become the wrong kind of stale: a checklist that
still asks for work that is already done.

Annotated tag on 7d41ccc, pushed. 217 commits since v1.0.0, not the 214 the
page still claimed - three doc commits landed after that count was written.
The build was re-run on the tagged commit rather than trusted from earlier in
the day: 870 tests, 0 failures. Gitea milestone 16 closed, 0 open PRs.

Also recorded that no Gitea release object was made. The tag is the artifact;
a release is a separate publish and was not asked for. Writing that down
stops a later session creating one and believing it was always expected.

Added the operator guide as item 8, since chapters 4 and 5 turned out never
to have been written and that was not on any checklist either.

8-Roadmap.md

@@ -232,9 +232,13 @@ commits** have landed on `main` with **no tag**. So the stage tables above are t
 the obvious question unanswered: what is actually left before the single-host story can be called
 finished?
 
-**The answer, as of 2026-08-17: nothing. The milestone is closed — 20 of 20.** Every ticket is
-merged, deployed, and verified on the running daemon. CB-596 was the last one, and it was closed on a
-measurement taken inside a live member pane, not on a merge. **The tag is the only step left.**
+**The answer, as of 2026-08-17: nothing. Release 1 is finished.** The milestone is closed — 20 of 20,
+every ticket merged, deployed, and verified on the running daemon. CB-596 was the last one, and it
+was closed on a measurement taken inside a live member pane, not on a merge.
+
+**`v1.1.0` is tagged and pushed**, on `7d41ccc`, with the build re-run on the tagged commit: 870
+tests, 0 failures. **217 commits since `v1.0.0`.** Gitea milestone 16 is closed and no pull requests
+are left open. The next line of work is milestone 17 — **2.0, one operation centre, many hosts.**
 
 Gitea milestone: **`1.1 — single-host close-out`**. The admission rule is one sentence — **if it
 would still be broken with exactly one host, it belongs in 1.1.** Read strictly, that rule sent four
@@ -380,8 +384,12 @@ Made 2026-08-16, by reading the admission rule strictly.
 6. ~~Run the verification probe.~~ Done, inside a live member pane. **29 of 29 blocked names hold the
    sentinel.** The probe itself covered 26 of them — see CB-608 — and the other three were measured
    directly.
-7. **Tag `v1.1.0`.** This is the only step left, and it is the operator's: tagging is outward-facing.
-   214 commits since `v1.0.0`.
+7. ~~Tag `v1.1.0`.~~ **Done, 2026-08-17.** The operator authorised it; the lead cut it. Annotated tag
+   on `7d41ccc`, pushed to `origin`, **217 commits since `v1.0.0`**, build re-run on the tagged
+   commit at 870 tests and 0 failures. Gitea milestone 16 closed, 0 open pull requests. No Gitea
+   *release* object was created — the tag is the artifact; a release is a separate publish.
+8. ~~Write the operator guide.~~ **Done, 2026-08-17** — [13 User Guide](13-User-Guide). Chapters 4
+   and 5 turned out never to have been written past their scope note, so they redirect to it now.
 
 **Not part of the tag, but do not lose it:** `GITEA_ACCESS_TOKEN` still needs rotating. A lead leaked
 about 31 characters of it into a transcript while dumping the *structure* of the secret store — the