docs: stats internal cert issued after DNS cache expiry

docs/launch-checklist.md

@@ -64,9 +64,8 @@ This, not Cloudflare, explains the 4-hour cert-manager DNS-01 stall of 2026-10-0
 
 - [ ] 🛑 Owner decision: leave as is, or exempt the k3s nodes from the redirect. The redirect rule
       is not in `~/Homelab/mikrotik/*.rsc`; find it on the router (or Pi-hole/AdGuard, if any).
-- [?] `umami-stats-tls` (internal hop for `stats`) was still pending on the stale NXDOMAIN at
-      18:30 UTC on launch day; it should issue by itself once the cache expires. Visitor-facing
-      TLS for `stats` is Pangolin's and is fine. Check with `kubectl -n umami get certificate`.
+- [x] `umami-stats-tls` (internal hop for `stats`) stalled on the stale NXDOMAIN at launch and
+      issued by itself once the cache expired (~18:35 UTC, 2026-10-23) — the expected pattern.
 
 ### 1.3 Gitea runner loses Docker after a dockerd restart
 `dockerd` on `gitea-1` runs with `live-restore=true`. When it restarts, containers keep running