tpm-enrol: pivot host enrolment to a Go binary, built out-of-VM

Replaces the shell/openssl-provider host enrolment (a35f2d6) with a static
Go + go-tpm binary, and moves BOTH host Go binaries out of the Packer VM.

fleet-enrol (files/enrol/, Go + go-tpm, no CGO):
  - talks to /dev/tpmrm0 DIRECTLY via transport.FromReadWriter(os.File) — no
    linuxtpm, so go-tpm is the only dep and there is NO tpm2-tools key-gen /
    openssl tpm2 provider / curl in the image (removes the biggest bench risk,
    the provider handle: key-ref).
  - ensures the ECDSA key @0x81010001, builds the CSR (crypto.Signer over the
    TPM key), POSTs CSR+context to the broker, shows the Plymouth fingerprint,
    polls /status, writes the leaf cert to NV 0x01800001.
  - tpmkey/ is an exported package so the TPM ceremony is tested against the
    go-tpm software simulator from a SEPARATE simtest/ module (CGO stays out of
    the shipped build). Transaction logic (mock broker) tested in-package.
  - deps pinned by go.sum (not vendored): the binary now builds on the CI
    runner, which has network — reproducible via pinned Go 1.26.4 + go.sum.

Out-of-VM build (decision): both fleet-enrol AND fleet-hostapi compile in the
CI "Build host Go binaries" step (Go 1.26.4, CGO off, -trimpath) and Packer
FILE-PROVISIONS the static binaries in. Dropped the in-VM `dnf install golang`
+ the 2d removal — the Rocky build image carries no Go toolchain / go-tpm tree.

Wiring:
  - tpm-enrol.sh: now a thin GATE (empty-NV check, pre-auth DHCP on en*,
    exec /usr/sbin/fleet-enrol, reboot-to-converge). module-setup.sh bundles the
    binary (asserted) + reverts the tpm2-openssl/curl installs.
  - diskless.pkr.hcl: file provisioners for both binaries; enrol installed to
    /usr/sbin before the initramfs build + fapolicyd-trusted; lsinitrd asserts
    fleet-enrol; dnf reverted to baseline (no tpm2-openssl/curl).
  - gitea-main-ci.yaml: Set up Go + build both binaries + run the simulator
    ceremony test, before packer validate.

TESTED here: transaction unit tests + the full TPM ceremony (key-gen -> persist
-> ECDSA sign -> CSR verify -> chunked NV write -> re-enrol) against the go-tpm
simulator. BENCH-VERIFY (real/swtpm, empty owner auth, pre-auth DHCP, Plymouth,
reboot-converge, prod HTTPS) tracked in docs/TODO.md #11.

docs/TODO.md

@@ -1001,32 +1001,43 @@ approve → cert). **BENCH-VERIFY:** run against real step-ca (`bootstrap.sh` ro
 `enrol` provisioner password readable by the broker) and confirm an issued cert
 authenticates EAP-TLS.
 
-**HOST SIDE BUILT 2026-07-02 (inline empty-NV branch) — awaiting bench.** New
-dracut hook `files/dracut/95dot1x-macsec/tpm-enrol.sh` (initqueue/settled prio 25,
-BEFORE dot1x-macsec-up at 30): on a secure build with an EMPTY NV `0x01800001` it
-generates the TPM key at `0x81010001`, builds a CSR via the openssl tpm2 provider,
-does a **pre-auth DHCP on the physical NIC** (re-manages `en*` via nmcli, overriding
-the secure-mode unmanaged drop-in), POSTs CSR+context to `rd.fleet.enrol_url`
-(default `http://boot.fleet.lab/enrol`), shows the broker fingerprint on Plymouth
-(`enrol-*` tokens + message line), polls `/status`, writes the issued leaf cert
-(DER) to NV, and **reboots into the secure path**. No-op when a cert is already
-present (normal boot) or under `rd.dot1x=0`. Wiring: `module-setup.sh`
-require+install the tpm2 key-gen tools + curl + the **openssl tpm2 provider**
-(`ossl-modules/tpm2.so`, asserted present); `diskless.pkr.hcl` installs
-`tpm2-openssl`+`curl` and asserts hook/tools/provider in the initramfs; new
-`enrol_url` Packer var → `rd.fleet.enrol_url` cmdline (extract-artifacts.sh). The
-shell JSON build/parse/cert-extract pipeline (no jq in initramfs) was verified
-against a live broker end-to-end.
+**HOST SIDE BUILT 2026-07-02 — Go binary (`fleet-enrol`), awaiting bench.**
+Pivoted from a shell hook to a static **Go + go-tpm** binary (`files/enrol/`):
+it talks to `/dev/tpmrm0` DIRECTLY (via `transport.FromReadWriter` on an
+`os.File` — no `linuxtpm`, so go-tpm is the only vendored dep), so the enrolment
+path needs **no tpm2-tools key-gen / no openssl tpm2 provider / no curl** in the
+image (removes the biggest bench risk — the provider `handle:` key-ref). It
+ensures the ECDSA key at `0x81010001`, builds the CSR, POSTs CSR+context to
+`rd.fleet.enrol_url`, shows the broker fingerprint on Plymouth, polls `/status`,
+and writes the leaf cert to NV `0x01800001`. The dracut hook `tpm-enrol.sh`
+(initqueue/settled prio 25) is now a thin GATE: empty-NV check (`tpm2_nvread`,
+still needed for the secure-path read) → pre-auth DHCP on `en*` (nmcli override of
+the secure-mode unmanaged drop-in) → `exec /usr/sbin/fleet-enrol` → reboot to
+converge on exit 0. No-op when a cert is present or under `rd.dot1x=0`.
 
-**BENCH-VERIFY (host side, before trusting):** (a) openssl tpm2 provider `handle:`
-key ref actually signs the CSR on the target (swtpm + real TPM) — the CLAUDE.md
-provider-vs-pkcs11 caveat; (b) empty-NV detection + the create/persist path on a
-truly-fresh TPM (owner auth empty); (c) pre-auth DHCP on `en*` in secure mode (the
-`nmcli device set managed yes` runtime override of nm-unmanaged.sh actually
-manages+leases the NIC); (d) the fingerprint renders on the `fleet` Plymouth theme
-+ the admin can match it; (e) NV write succeeds (TPM owner auth) and the **reboot
-converges** — 2nd boot finds the cert and runs the secure path; (f) prod: the
-broker endpoint over **HTTPS** (curl `--cacert radius-ca.pem`), currently lab-HTTP.
+**Built OUT OF THE VM (2026-07-02, per decision):** `fleet-enrol` AND
+`fleet-hostapi` now compile on the CI runner (`.gitea/workflows/gitea-main-ci.yaml`
+"Build host Go binaries" step, Go 1.26.4, `CGO_ENABLED=0`, vendored/stdlib,
+`GOPROXY=off`), and Packer **file-provisions** the static binaries in — the Rocky
+build image no longer carries the Go toolchain (dropped the in-VM `dnf install
+golang` + the 2d removal). `fleet-enrol` lands at `/usr/sbin` before the initramfs
+build (dracut `inst_simple`s it; asserted in `lsinitrd`), fapolicyd-trusted.
+New `enrol_url` Packer var → `rd.fleet.enrol_url` cmdline.
+
+**TESTED (2026-07-02):** transaction logic (CSR → mock broker → approve → cert
+extract) as stdlib unit tests, AND the **full TPM ceremony (key-gen → persist →
+ECDSA sign → CSR verify → chunked NV write → re-enrol) against the go-tpm software
+simulator** (separate `files/enrol/simtest/` module so the CGO simulator never
+enters the shipped build). Both run in CI.
+
+**BENCH-VERIFY (host side, before trusting):** (a) go-tpm against a REAL TPM +
+swtpm on the target (the simulator proves the ceremony, not the device); (b)
+empty-NV create/persist on a fresh TPM with **empty owner auth** (the code assumes
+it — a set owner auth needs handling); (c) pre-auth DHCP on `en*` in secure mode
+(the `nmcli set managed yes` override of nm-unmanaged.sh actually leases); (d)
+fingerprint renders on the `fleet` Plymouth theme + admin can match it; (e) NV
+write + **reboot converges** (2nd boot runs the secure path); (f) prod: broker over
+**HTTPS** (`fleet-enrol -cacert radius-ca.pem`), currently lab-HTTP.
 
 **TEMPORARY (2026-06-28): broker also added to the MAIN serving stack**
 (`serving/docker-compose.yml`, `enrol-broker` service + `ENROL_*` in

docs/tpm-enrolment-design.md

@@ -323,13 +323,16 @@ exists. Enrolment is where it comes into being.
    can't authenticate to the admin plane. End-to-end smoke-tested (CSR → mTLS
    approve → cert; pubkey match). Ships in `serving/dot1x-bench/docker-compose.yml`.
 3. **Host side — BUILT 2026-07-02 (awaiting bench):** the **inline empty-NV
-   trigger** — dracut hook `95dot1x-macsec/tpm-enrol.sh` (initqueue/settled prio
-   25) generates key/CSR (openssl tpm2 provider), pre-auth-DHCPs the physical NIC,
-   POSTs to the broker, shows the fingerprint on Plymouth, polls, writes the leaf
-   cert to NV `0x01800001`, and reboots into the secure path. No-op when a cert is
-   already present or under `rd.dot1x=0`. Ships `tpm2-openssl`+`curl` in the image
-   (asserted in the initramfs); `enrol_url` Packer var → `rd.fleet.enrol_url`.
-   BENCH-VERIFY list in `docs/TODO.md` #11.
+   trigger** as a static **Go + go-tpm** binary (`files/enrol/`, `fleet-enrol`)
+   talking to `/dev/tpmrm0` directly — ensures the key at `0x81010001`, builds the
+   CSR, POSTs to the broker, shows the Plymouth fingerprint, polls, writes the leaf
+   cert to NV `0x01800001`. A thin dracut GATE hook (`95dot1x-macsec/tpm-enrol.sh`,
+   initqueue/settled prio 25) does the empty-NV check + pre-auth DHCP on the
+   physical NIC + reboot-to-converge. No tpm2-tools key-gen / openssl provider /
+   curl needed in the image (go-tpm does it all). Built **out of the VM** on the CI
+   runner + file-provisioned in (like `fleet-hostapi`); `enrol_url` Packer var →
+   `rd.fleet.enrol_url`. TESTED: transaction (mock broker) + full TPM ceremony vs
+   the go-tpm simulator (`files/enrol/simtest/`). BENCH-VERIFY list in `docs/TODO.md` #11.
 4. **Folds into fleet-manager:** the admin routes become the mgmt service's
    authenticated plane; approval writes the shared inventory record.
 5. **Provisioning-UKI variant** (`enrol_mode`) — move enrolment out of the production