docs: nixos-and-infra roadmap Done table omits the #456 sops completion (PR #453) — still says none recorded yet #457

Problem

planning/roadmaps/nixos-and-infra.md — the roadmap that covers sops/ (its scope line names flake.nix, lib/, nixos/, keys/, sops/) — still records no completed work at all, even though a sops fix landed today.

Evidence, verified on main at 6146abba:

• planning/roadmaps/nixos-and-infra.md Done table is a single placeholder row: (none recorded yet).
• grep -rn "456" ROADMAP.md planning/roadmaps/ returns no matches.
• PR #453's Open Design sops file: .sops.yaml has no rule for its sandbox recipient — updatekeys silently drops it, and treefmt fails on the file #456 is CLOSED (2026-10-21T04:06:56Z): "PR secrets: Open Design API key (SOPS) #453's Open Design sops file: .sops.yaml has no rule for its sandbox recipient — updatekeys silently drops it, and treefmt fails on the file".
• PR secrets: Open Design API key (SOPS) #453 MERGED 2026-10-21T04:06:54Z (merge commit 6146abba): it added the path-scoped dual-recipient rule to .sops.yaml and treefmt-formatted secrets/opendesign.sops.yaml, closing PR #453's Open Design sops file: .sops.yaml has no rule for its sandbox recipient — updatekeys silently drops it, and treefmt fails on the file #456.

So the first completed item in this roadmap's scope is invisible in the roadmap — a reader following the planning rule ("finished items are kept in each project's roadmap, in its Done table", top-level ROADMAP.md) concludes nothing has ever shipped here.

Why it matters

The roadmap Done tables are how this repo records completions (see the prior rounds #412/#426/#450/#454 for the other roadmap files). This file is the only one still on its placeholder, and its first real completion has now landed unrecorded.

Acceptance criteria

• planning/roadmaps/nixos-and-infra.md Done table gains a row for the PR #453's Open Design sops file: .sops.yaml has no rule for its sandbox recipient — updatekeys silently drops it, and treefmt fails on the file #456 completion (PR secrets: Open Design API key (SOPS) #453), dated 2026-10-21, replacing the (none recorded yet) placeholder.
• No other roadmap rows change.

Single-repo: the sops fix and this roadmap file both live only in this repo.