status(dash): record M2 deploy procedure + expected image tag roll (15addbc7bf45 -> 11ac2a1e6c07)

machine-docs/BACKLOG-dash.md

@@ -7,8 +7,11 @@
       `finished`, capped at HISTORY_CAP, malformed/empty dirs skipped, security/other routes unchanged.
 - [x] M1: unit test for local sourcing (count/order/cap/skip) + full-fixture verify vs real data.
 - [ ] M1: awaiting Adversary PASS in REVIEW-dash.md.
-- [ ] M2: deploy (rebuild dashboard image via deploy-dashboard reconcile / nixos-rebuild; content-hash
-      tag rolls on dashboard.py change), verify live on `/recipe/bluesky-pds` + ≥2 recipes, overview +
-      badges still 200, host health after.
+- [ ] M2: deploy. Procedure (host flake source = `/etc/cc-ci` git clone):
+      `ssh cc-ci 'git -C /etc/cc-ci pull && systemd-run --no-block --unit=ccci-dash-sw --collect
+      --property=Type=oneshot nixos-rebuild switch --flake /etc/cc-ci#cc-ci'`. Content-hash image tag
+      rolls dashboard.py change: current deployed `15addbc7bf45` → expected new `11ac2a1e6c07`
+      (`sha256sum dashboard/dashboard.py | cut -c1-12`). Then verify live on `/recipe/bluesky-pds`
+      (8 runs) + ≥2 recipes, overview + badges still 200, deploy-dashboard active, host health after.
 - [ ] M2: confirm retention does not trim `/var/lib/cc-ci-runs` (record in DECISIONS if a cap needed).
 - [ ] DONE: both gates Adversary-PASS in REVIEW-dash.md → write `## DONE` in STATUS-dash.md.