docs: record Serenity DNS and cloudflared retirement

docs/planning/SERENITY_DOCKER_AUDIT.md

@@ -67,14 +67,13 @@ These should be treated as cleanup targets unless a specific live dependency is
 
 - `Unraid-Cloudflared-Tunnel`
   - live audit on 2026-05-25 showed a remote-managed Cloudflare Tunnel with stale legacy `192.168.1.x` origins and zero observed proxied requests on the current run
-  - public hostnames in its remote config now appear to be served elsewhere, so it should be removed after a brief stop/remove observation window rather than treated as an active dependency
+  - stopped and removed on 2026-05-25 after post-stop checks showed sampled public hostnames remained healthy without it
 - `binhex-official-pihole`
 - `pihole-serenity`
 - `unbound-pihole-serenity`
 - `keepalived-pihole-serenity`
-  - these are legacy DNS/HA remnants now that Technitium is the active resolver strategy
-  - repo docs now describe the Technitium trio as the active DHCP-advertised internal DNS path
-  - operator confirmed Technitium covers the intended DNS role, so these should be treated as removable at the next cleanup window
+  - these were legacy DNS/HA remnants once Technitium became the intended resolver strategy
+  - mixed-host DNS verification passed during retirement on 2026-05-25, and the Serenity Pi-hole HA stack was then stopped and removed without immediate DNS regression
 - `postgresql15`
 - `MariaDB-Official`
   - both are live, but they are suspicious because current docs position PD as the shared database home