chore: initial import from KNEL/PFVCluster@041d311 [#769]

Split per O&M lane work order. Full history: KNEL/PFVCluster.
https://projects.knownelement.com/issues/769#note-4152

selftest.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+#
+# selftest.sh — throwaway end-to-end CA loop in /tmp [#697]
+# TDD gate for the CA tooling: init -> issue -> verify chain -> negative check.
+#
+set -euo pipefail
+T="$(mktemp -d)"
+trap 'rm -rf "$T"' EXIT
+
+bash "$(dirname "$0")/ca-init.sh" "$T/root" "$T/int" > /dev/null
+[ -s "$T/root/root.key" ] && [ -s "$T/int/intermediate.crt" ] || { echo "FAIL: init" ; exit 1; }
+
+INT_DIR="$T/int" bash "$(dirname "$0")/issue-cert.sh" test.knel.net "DNS:test.knel.net,IP:10.0.0.1" > /dev/null
+openssl verify -CAfile "$T/root/root.crt" "$T/int/intermediate.crt" > /dev/null
+openssl x509 -in "$T/int/certs/test.knel.net.crt" -noout -ext subjectAltName | grep -q "test.knel.net"
+openssl x509 -in "$T/int/certs/test.knel.net.fullchain" -noout | head -1 > /dev/null
+echo "SELFTEST PASS: root->intermediate->leaf chain verified with SANs"