tpm-enrol: pivot host enrolment to a Go binary, built out-of-VM

Replaces the shell/openssl-provider host enrolment (a35f2d6) with a static
Go + go-tpm binary, and moves BOTH host Go binaries out of the Packer VM.

fleet-enrol (files/enrol/, Go + go-tpm, no CGO):
  - talks to /dev/tpmrm0 DIRECTLY via transport.FromReadWriter(os.File) — no
    linuxtpm, so go-tpm is the only dep and there is NO tpm2-tools key-gen /
    openssl tpm2 provider / curl in the image (removes the biggest bench risk,
    the provider handle: key-ref).
  - ensures the ECDSA key @0x81010001, builds the CSR (crypto.Signer over the
    TPM key), POSTs CSR+context to the broker, shows the Plymouth fingerprint,
    polls /status, writes the leaf cert to NV 0x01800001.
  - tpmkey/ is an exported package so the TPM ceremony is tested against the
    go-tpm software simulator from a SEPARATE simtest/ module (CGO stays out of
    the shipped build). Transaction logic (mock broker) tested in-package.
  - deps pinned by go.sum (not vendored): the binary now builds on the CI
    runner, which has network — reproducible via pinned Go 1.26.4 + go.sum.

Out-of-VM build (decision): both fleet-enrol AND fleet-hostapi compile in the
CI "Build host Go binaries" step (Go 1.26.4, CGO off, -trimpath) and Packer
FILE-PROVISIONS the static binaries in. Dropped the in-VM `dnf install golang`
+ the 2d removal — the Rocky build image carries no Go toolchain / go-tpm tree.

Wiring:
  - tpm-enrol.sh: now a thin GATE (empty-NV check, pre-auth DHCP on en*,
    exec /usr/sbin/fleet-enrol, reboot-to-converge). module-setup.sh bundles the
    binary (asserted) + reverts the tpm2-openssl/curl installs.
  - diskless.pkr.hcl: file provisioners for both binaries; enrol installed to
    /usr/sbin before the initramfs build + fapolicyd-trusted; lsinitrd asserts
    fleet-enrol; dnf reverted to baseline (no tpm2-openssl/curl).
  - gitea-main-ci.yaml: Set up Go + build both binaries + run the simulator
    ceremony test, before packer validate.

TESTED here: transaction unit tests + the full TPM ceremony (key-gen -> persist
-> ECDSA sign -> CSR verify -> chunked NV write -> re-enrol) against the go-tpm
simulator. BENCH-VERIFY (real/swtpm, empty owner auth, pre-auth DHCP, Plymouth,
reboot-converge, prod HTTPS) tracked in docs/TODO.md #11.

docs/tpm-enrolment-design.md

@@ -323,13 +323,16 @@ exists. Enrolment is where it comes into being.
    can't authenticate to the admin plane. End-to-end smoke-tested (CSR → mTLS
    approve → cert; pubkey match). Ships in `serving/dot1x-bench/docker-compose.yml`.
 3. **Host side — BUILT 2026-07-02 (awaiting bench):** the **inline empty-NV
-   trigger** — dracut hook `95dot1x-macsec/tpm-enrol.sh` (initqueue/settled prio
-   25) generates key/CSR (openssl tpm2 provider), pre-auth-DHCPs the physical NIC,
-   POSTs to the broker, shows the fingerprint on Plymouth, polls, writes the leaf
-   cert to NV `0x01800001`, and reboots into the secure path. No-op when a cert is
-   already present or under `rd.dot1x=0`. Ships `tpm2-openssl`+`curl` in the image
-   (asserted in the initramfs); `enrol_url` Packer var → `rd.fleet.enrol_url`.
-   BENCH-VERIFY list in `docs/TODO.md` #11.
+   trigger** as a static **Go + go-tpm** binary (`files/enrol/`, `fleet-enrol`)
+   talking to `/dev/tpmrm0` directly — ensures the key at `0x81010001`, builds the
+   CSR, POSTs to the broker, shows the Plymouth fingerprint, polls, writes the leaf
+   cert to NV `0x01800001`. A thin dracut GATE hook (`95dot1x-macsec/tpm-enrol.sh`,
+   initqueue/settled prio 25) does the empty-NV check + pre-auth DHCP on the
+   physical NIC + reboot-to-converge. No tpm2-tools key-gen / openssl provider /
+   curl needed in the image (go-tpm does it all). Built **out of the VM** on the CI
+   runner + file-provisioned in (like `fleet-hostapi`); `enrol_url` Packer var →
+   `rd.fleet.enrol_url`. TESTED: transaction (mock broker) + full TPM ceremony vs
+   the go-tpm simulator (`files/enrol/simtest/`). BENCH-VERIFY list in `docs/TODO.md` #11.
 4. **Folds into fleet-manager:** the admin routes become the mgmt service's
    authenticated plane; approval writes the shared inventory record.
 5. **Provisioning-UKI variant** (`enrol_mode`) — move enrolment out of the production