tpm-enrol: move signing key off the EK slot 0x81010001 → 0x81000100

Bench (Proxmox vTPM, host cygnus-cruiser-99) confirmed via tpm2_readpublic that
0x81010001 — the handle our design used for the fleet signing key — is the
TCG-standard RSA Endorsement Key slot: the object there is the swtpm-provisioned
EK (restricted|decrypt|adminwithpolicy, RSA-2048/AES128CFB, canonical EK
authPolicy 837197…, EK cert at NV 0x1c00002). Most firmware/swtpm TPMs occupy
that slot, so EnsureKey could never create our key there — it errored reading
the EK as ECC and enrolment died before the CSR/POST.

Move the fleet signing key to 0x81000100, a non-reserved owner persistent
handle (clear of EK 0x81010001/2 and SRK 0x81000001/2). Threaded through:
  - fleet-enrol -handle default + new rd.dot1x.handle= cmdline knob (baked by
    extract-artifacts.sh, overridable via SMBIOS)
  - files/etc/dot1x/wpa_supplicant-dot1x.conf private_key handle
  - the dracut hook, bench tpm-provision.sh / tpm-selftest.sh
  - CLAUDE.md invariant #1 + design/SSP docs + TODO #11
NV index 0x01800001 (owner range) is unchanged.

EnsureKey hardening: refuse to evict any restricted-decrypt object (EK/SRK) as
a safety net — never clobber the TPM endorsement/storage identity (also
protects the future EK/AK attestation path). Still self-heals a genuine stale
signing key. New regression TestEnsureKeyRefusesToEvictProtectedKey; the
stale-key regression and handle constants moved to 0x81000100.

Design note records the IDevID (0x81020001) option for the later EK/AK
attestation work. Follow-up items logged: content-aware NV presence check
(verify the cert chains to the fleet CA, so leftover/foreign NV can't suppress
enrolment) and a de-enrol/TPM-reset procedure.

docs/tpm-enrolment-design.md

@@ -8,7 +8,7 @@ end-to-end *minus* the human-approval queue; the only unbuilt piece is the
 **enrolment broker**.
 
 How a diskless host acquires — and keeps — its **one cryptographic identity**: a
-signing key at TPM handle `0x81010001` and a cert at NV index `0x01800001`.
+signing key at TPM handle `0x81000100` and a cert at NV index `0x01800001`.
 Invariant #1 forbids baking any per-host state into the image, so this identity
 **must** be minted at enrolment, at runtime, from the TPM. That single identity is
 then reused for everything: **802.1X EAP-TLS**, the **NVMe hostnqn** (derived from
@@ -28,7 +28,7 @@ separate box — is what makes the two designs one coherent identity story.
 
 ## Design philosophy (forced by the architecture invariants)
 
-1. **One identity, minted once, reused everywhere.** Key `0x81010001` + cert
+1. **One identity, minted once, reused everywhere.** Key `0x81000100` + cert
    NV `0x01800001` = 802.1X identity = NVMe hostnqn (`…:host-<cert-serial>`) =
    mTLS client identity. There is no second secret. (Invariant #1.)
 2. **The private key never leaves the TPM.** Generated *in* the TPM; only a CSR
@@ -74,7 +74,7 @@ are deliberately **split** — conflating them is a security regression:
 
 ### 1. TPM key + NV cert (exists — `tpm-provision.sh`)
 
-Key generated in the TPM, persisted at `0x81010001`; CSR built with it via the
+Key generated in the TPM, persisted at `0x81000100`; CSR built with it via the
 openssl tpm2 provider (key never leaves the TPM); issued cert written DER to NV
 `0x01800001`. At boot, `dot1x-macsec-up.sh` reads the cert from NV, wpa_supplicant
 signs EAP-TLS with the handle key, and the hostnqn is derived from the cert serial.
@@ -158,7 +158,7 @@ pinned for mTLS — one trust anchor across 802.1X, NVMe, and management.
 ```
   empty-NV host (early-boot enrol branch) broker (= fleet-mgr bootstrap)     admin        step-ca
   ───────────────────────────────         ─────────────────────────────     ─────        ───────
-  1. key in TPM @0x81010001
+  1. key in TPM @0x81000100
   2. build CSR (key never leaves)
   3. POST /enrol/request (CSR+context) ─▶  create PENDING, pick nonce,
                                            compute fingerprint
@@ -295,6 +295,26 @@ point (verify the attestation statement before signing). The CA bootstrap alread
 carries a commented `acme-attest` provisioner block
 (`serving/dot1x-bench/step-ca/bootstrap.sh`).
 
+### Signing-key handle choice (and the IDevID option)
+
+The fleet signing key is persisted at **`0x81000100`** — a non-reserved **owner**
+persistent handle. It is deliberately **not** the EK slot `0x81010001` / `0x81010002`
+nor the SRK `0x81000001` / `0x81000002`: firmware and swtpm provisioning routinely
+occupy those (bench-confirmed 2026-07-02 — a Proxmox vTPM had the standard **RSA
+Endorsement Key** at `0x81010001`, restricted-decrypt, with the canonical EK
+authPolicy `837197…`, and its EK cert at NV `0x1c00002`). `EnsureKey` therefore
+also refuses to evict any restricted-decrypt object as a safety net. The handle is
+overridable via `rd.dot1x.handle=` / `fleet-enrol -handle`.
+
+**Future option — IDevID (`0x81020001`):** if/when the EK/AK attestation path above
+lands, the natural home for a TPM-resident *device identity* key is the TCG
+**IDevID** handle `0x81020001` (with **LDevID** at `0x81030001`), per *TPM 2.0 Keys
+for Device Identity and Attestation*. Moving there would align our key with the
+IDevID template + EK-anchored certification flow (the key is certified by an AK that
+chains to the EK) rather than a bare owner primary. Not adopted for v1 (it implies
+the full IDevID template/cert conventions we don't yet follow); revisit together with
+`device-attest-01`.
+
 ## Inventory record born at enrolment
 
 ```
@@ -324,7 +344,7 @@ exists. Enrolment is where it comes into being.
    approve → cert; pubkey match). Ships in `serving/dot1x-bench/docker-compose.yml`.
 3. **Host side — BUILT 2026-07-02 (awaiting bench):** the **inline empty-NV
    trigger** as a static **Go + go-tpm** binary (`files/enrol/`, `fleet-enrol`)
-   talking to `/dev/tpmrm0` directly — ensures the key at `0x81010001`, builds the
+   talking to `/dev/tpmrm0` directly — ensures the key at `0x81000100`, builds the
    CSR, POSTs to the broker, shows the Plymouth fingerprint, polls, writes the leaf
    cert to NV `0x01800001`. A thin dracut GATE hook (`95dot1x-macsec/tpm-enrol.sh`,
    initqueue/settled prio 25) does the empty-NV check + pre-auth DHCP on the