feat(proof-vm-agent): boot-check TLS SANs for the dedicated droplet, cert helper (Architecte follow-up 2/4)

[echobt]

Summary

Replacement for closed #249 (auto-closed when #248's head branch was deleted on squash-merge). Rebased onto main after #248 (f6e5012).

Architecte / Owner follow-up 2 of 4 (TLS SAN — hostname / VPC IP of the dedicated droplet).

Problem. The CP's rustls client (proof-vm-fc) refuses a certificate without a SAN for the host in PROOF_VM_ORCHESTRATOR_URL. Staging minted a certificate for the docker gateway (172.18.0.1). That is worthless on the dedicated prod droplet.

Agent (bins/proof-vm-orchestrator)

• New --tls-sans / PROOF_VM_AGENT_TLS_SANS: every host the CP's URL may name. Required with a wildcard bind.
• Boot check with webpki (EndEntityCert::verify_is_valid_for_subject_name): miss exits 1 with the fix command.
• Tests: names from the list / specific bind / wildcard refusal; rcgen certs; helper round-trip.

Helper (deploy/scripts/proof-vm-agent-tls.sh) — mints CA + leaf under /etc/proof-vm with SANs from --san, env, bind host, hostname, VPC IPv4 on eth1.

Fail-closed, minimal wire impact: no protocol change, no CP change.

Greptile

• Greptile has reviewed this PR; findings are fixed or answered
• If the bot was silent, I commented @greptileai review

Test plan

• Rebased cleanly onto main after fix(proof-vm-agent): install rustls provider at boot, drop aws-lc-rs (Architecte follow-up 1/4) #248 squash
• CI fmt · clippy · test · deny · xtask
• Greptile Review SUCCESS, unresolved threads = 0

Risk

Deploy only (host agent + operator script + docs). No miner CVM / signature / emission impact. Prod host hold.

[echobt]

@greptileai please review TLS SAN boot-check (Architecte follow-up 2/4, replacement for closed #249 after #248 squash).

[greptile-apps]

Greptile Summary

This change adds a fail-closed TLS SAN startup check for the Proof VM orchestrator and an operator helper that mints matching private-CA certificates. The service rejects certificates that omit a configured DNS name or IP address and accepts certificates containing the complete configured SAN set.

Confidence Score: 5/5

Safe to merge.

No actionable issue was found. The focused certificate checks exercised rejection of a missing required SAN and acceptance of a helper-minted certificate with matching DNS and IP SANs.

Files Needing Attention: None.

T-Rex Logs

What T-Rex did

• Executed the TLS SAN validation script to drive the test and exercise both negative-side and positive-side checks.
• Reviewed the TLS SAN before log to confirm the missing-required-SAN rejection assertion was recorded.
• Reviewed the TLS SAN after log to confirm the DNS/IP SAN extension was applied, CA validation succeeded, and the changed-path helper test ran.
• Verified that tls-san-validate.sh was the source executed for the run.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "feat(proof-vm-agent): boot-check tls san..." | Re-trigger Greptile}