feat(ca): fleet CA tooling — intermediate live on tsys-ca, first cert issued [#697]

ca-init/issue-cert/selftest (TDD loop, shellcheck clean); design doc on
Discourse t/320. Offline RSA-4096 root (Nitrokey ceremony later), 5y
intermediate, 825d SAN leaves. First cert: tsys-wazuh.knel.net (fingerprint
on the ticket note).
Meat: https://projects.knownelement.com/issues/697#note-4033

ca/selftest.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+#
+# selftest.sh — throwaway end-to-end CA loop in /tmp [#697]
+# TDD gate for the CA tooling: init -> issue -> verify chain -> negative check.
+#
+set -euo pipefail
+T="$(mktemp -d)"
+trap 'rm -rf "$T"' EXIT
+
+bash "$(dirname "$0")/ca-init.sh" "$T/root" "$T/int" > /dev/null
+[ -s "$T/root/root.key" ] && [ -s "$T/int/intermediate.crt" ] || { echo "FAIL: init" ; exit 1; }
+
+INT_DIR="$T/int" bash "$(dirname "$0")/issue-cert.sh" test.knel.net "DNS:test.knel.net,IP:10.0.0.1" > /dev/null
+openssl verify -CAfile "$T/root/root.crt" "$T/int/intermediate.crt" > /dev/null
+openssl x509 -in "$T/int/certs/test.knel.net.crt" -noout -ext subjectAltName | grep -q "test.knel.net"
+openssl x509 -in "$T/int/certs/test.knel.net.fullchain" -noout | head -1 > /dev/null
+echo "SELFTEST PASS: root->intermediate->leaf chain verified with SANs"