[#800] prod step-ca ACME endpoint LIVE on tsys-ca (fleet-root chain); http-01 validation fetch open

compose.yaml: host networking (bridge+embedded-DNS broke rooted-name
lookups), :8443 via ca.json address, image digest-pinned; init-stepca.sh:
scaffold + ECDSA-P256 intermediate signed by /root/ca-root fleet root
(verified), ACME provisioner, managed password. Directory serving
RFC8555 on tailnet. OPEN: step-ca validation GET fails instantly with
zero dial attempts (authz says could-not-connect) — bisected caps,
read_only, bridge vs host, container DNS. Debug continues next run
(GODEBUG=netdns=2 + strace plan).
https://projects.knownelement.com/issues/800

docker/stepca-prod/compose.yaml

@@ -0,0 +1,26 @@
+# step-ca PROD ACME endpoint on tsys-ca [#800 #697]
+#
+# Bring-your-own-chain: intermediate signed by the fleet root (offline
+# /root/ca-root), served on the TAILNET only. HTTP-01 challenges do NOT hit
+# this box — ACME clients serve them on the target host's port 80.
+#
+# Files expected next to this compose (created by init-stepca.sh):
+#   data/          step home (config, certs, secrets; uid 1000)
+# Init (first deploy only): bash init-stepca.sh   (run on tsys-ca as root)
+# Verify:  curl -k https://100.102.96.24:8443/acme/acme/directory
+#
+# PROVISIONER: ACME provisioner named "acme" is added by init-stepca.sh
+# (step ca provisioner add acme --type ACME) after scaffolding.
+
+services:
+  stepca:
+    image: smallstep/step-ca@sha256:e9e8fa3262bf37b130962ffddbf6a64ac188f0bbb80959cf3ddc04c6bf294c3d
+    container_name: ukrrs-oam-ca-stepca
+    restart: unless-stopped
+    # step-ca validates http-01 by dialing the ROOTED target name; docker's
+    # embedded DNS on tsys-ca cannot answer absolute tailnet FQDNs, so pin
+    # the tailscale resolver (MagicDNS) explicitly.
+    network_mode: host
+    volumes:
+      - ./data:/home/step
+    # hardening (read_only+caps) re-enabled after validation debugging