ops: pfi-gx10 DGX OTA 7.6 + reboot, vm-esh-nas + ana-docker reboots (engine 29.8.0), crowdsec bouncer updateMaxFailure 3; docs

docs/runbooks/fleet-guest-patch-2026-10-05.md

@@ -116,7 +116,10 @@ bouncer failing closed on slow LAPI answers. Self-cleared.
 **Deferred to a daytime window:**
 - reboots to activate new kernels: ~~nh3-extdev, corviduo-dev, esh-vm-db, pfi-pteradactyl~~ (rebooted 2026-10-05
   1055–1109 on Prime's word; all came back clean, boot ids changed, 0 failed units). pfi-tacticalrmm rebooted + TRMM updated to 1.5.2
-  by Prime ~1110 (verified: 0 failed units, cert intact). Still pending: ana-docker, nh3-dev, vm-esh-nas. None builds NVIDIA with DKMS. ⚠ corviduo-dev's Worldtree APIs take ~3 min to answer
+  by Prime ~1110 (verified: 0 failed units, cert intact). vm-esh-nas rebooted ~1115 (NFS mounts + containers back). ana-docker: Docker engine
+  29.4.1 → 29.8.0 + reboot ~1123–1133 (Prime), 44/44 containers identical to the pre-snapshot, gateway/gitea/CrowdSec OK.
+  ⚠ ana-docker's Docker apt source points at `bullseye` on a bookworm host (it installs bullseye builds). It works, but
+  repoint it at bookworm deliberately some day. Still pending: nh3-dev (reboot + engine). None builds NVIDIA with DKMS. ⚠ corviduo-dev's Worldtree APIs take ~3 min to answer
   `/health` after boot (startup, not a fault); wings on pfi-pteradactyl restores the running game server by itself.
 - Docker engine bumps held on ana-docker, nh3-docker, esh-docker-vm, corviduo-dev, nh3-dev, esh-ml1, nh3-ml1, pfi-gx10.
 - fv-ml1: ZFS 2.3.9, nvidia-container-toolkit 1.20, and a kernel with an NVIDIA driver that builds on it.