Publish Certificate Material for a hostname or wildcard #1022

Parent

Spec: Hosted DNS, Cluster Domain and wildcard certificates

What to build

A Cluster accepts operator- or Cloud-supplied Certificate Material for an explicit hostname or a single-level wildcard through one new frozen RPC, PublishCertificateMaterial { hostname, set { chain, key } | clear }. Published material is served as given and never touched by ACME; a published wildcard covers matching hostnames so the daemon orders nothing for them.

Acceptance criteria

• RPC catalog row, request/response types and SDK method; advertised as a Cluster capability; contract and capability tests updated.
• Set validates the chain, the key match, and that the leaf covers the hostname; refusals are explicit.
• Certificate row gains optional published (default false, additive); ACME never orders, renews or overwrites published material.
• Clear removes the material and returns the hostname to ACME.
• Hostnames covered by a published *.x are skipped by certificate issuance; Caddy serves the wildcard by SNI.
• Layer-3 certificates suite covers set, never-renewed, clear-to-ACME and wildcard coverage.

Blocked by

• Freeze tolerant daemon store and enrollment contracts #989