docs(agent): defer #20 KVM CI to FUTURE; keep eval-only VPS

Standing decision: IONOS Gitea/act_runner docker stays eval-tier.
vm-checks needs a separate KVM host later — not the 4G compose box.

agent/BACKLOG.md

@@ -24,17 +24,11 @@ in [`docs/ROADMAP.md`](../docs/ROADMAP.md); map in
 
 ## NOW
 
-*(empty — NEXT's top item is the queue head)*
+*(empty — NEXT is empty; see LATER / FUTURE / PROPOSED)*
 
 ## NEXT
 
-### 20. KVM runner → VM suite in CI `[human]`
-The remaining stretch of the CI item — checks-on-push is live and
-**green** (run #58; runner = gitea/act_runner docker, eval tier).
-Register a second runner on a host with `/dev/kvm` + nix (host-mode
-label `nix-kvm`), then an agent uncomments the workflow's `vm-checks`
-job: the `checks.*` VM suite + real toplevel/HM builds on every push
-that later upgrades the bump gate from eval-only to the full suite.
+*(empty — no actionable queue head; #20 deferred to FUTURE)*
 
 ## LATER
 

agent/MEMORY.md

@@ -30,12 +30,12 @@ iteration would otherwise rediscover.
   realise it): extract the logic into a pure importable file and
   unit-test THAT (monitor-rules.nix / checks.display-profiles is the
   pattern).
-- CI (`.gitea/workflows/check.yml`) is **eval-tier only**: the act_runner
-  is a docker container (no systemd, no /dev/kvm). Container gotchas are
-  documented in the workflow header (single-user Nix + nixbld users,
-  `sandbox=false` for Stylix IFD, Nix pinned 2.31.5 vs lazy-trees, no JS
-  actions past node20) — learned over the legacy repo's 57 runs; read
-  them before touching the workflow.
+- CI (`.gitea/workflows/check.yml`) is **eval-tier only** (standing
+  decision 2026-07-10): act_runner docker-compose on the Gitea VPS; no
+  KVM there. Full VM suite is BACKLOG **FUTURE #20**, not NEXT — needs a
+  separate nix+/dev/kvm runner. Container gotchas are in the workflow
+  header (single-user Nix + nixbld users, `sandbox=false` for Stylix
+  IFD, Nix pinned 2.31.5 vs lazy-trees, no JS actions past node20).
 - The Gitea instance is **1.25.4** — `on: schedule` workflows are
   supported; bump.yml assumes the Actions token can push to `main`
   (standard Gitea behaviour, but unconfirmed until the first run lands).