tpm-enrol: move NV cert index off OEM-occupied 0x01800001 → 0x01800100

The Dell 820 kept "finding a cert" and bypassing enrolment despite repeated BIOS
TPM clears. tpm2_nvreadpublic revealed 0x01800001 on that hardware is a FIRMWARE
platform index (platformcreate|policydelete|writelocked, 70 bytes — not our
cert; siblings at 0x01800003/4 + 0x01810000). platformcreate survives TPM2_Clear
and policydelete needs the platform's secret policy, so it's permanent and
unusable by us — the blind check false-positived on it, and enrolment could
never write there anyway. Same class of bug as the EK-handle collision.

Move the NV cert index default 0x01800001 -> 0x01800100 (free on the 820, owner
range, overridable via rd.dot1x.nvindex): cmdline (extract-artifacts.sh),
fleet-enrol -nvindex, the dracut hooks, bench scripts, CLAUDE.md invariant #1,
and design/SSP docs. The signing-key handle (0x81000100) is unchanged.

Harden WriteNVCert: refuse a platformcreate index with a clear "pick a free
owner index via rd.dot1x.nvindex" error instead of a confusing undefine
failure. Regression simtest/TestWriteNVCertRefusesPlatformIndex; NV roundtrip +
ReadNVCert tests moved to 0x01800100. All go tests + packer validate pass.

docs/TODO.md

@@ -783,7 +783,7 @@ smoke test.
     returns MSK); a `hostapd` wired authenticator does 802.1X + MACsec on an
     **isolated bridge per workstation** (flat VLAN can't auth — EAPOL dropped +
     MACsec is P2P). `enrol/tpm-provision.sh` creates the key in the TPM at
-    `0x81000100` + writes the cert to NV `0x01800001`. Starting solution **signs a
+    `0x81000100` + writes the cert to NV `0x01800100`. Starting solution **signs a
     CSR** (key stays in TPM); **TPM attestation** (ACME `device-attest-01`) is the
     documented upgrade on the same CA. **BENCH-VERIFY** items flagged in the files:
     hostapd MACsec build, openssl tpm2 provider vs pkcs11 key ref, EAP-TLS version.
@@ -1026,7 +1026,7 @@ path needs **no tpm2-tools key-gen / no openssl tpm2 provider / no curl** in the
 image (removes the biggest bench risk — the provider `handle:` key-ref). It
 ensures the ECDSA key at `0x81000100`, builds the CSR, POSTs CSR+context to
 `rd.fleet.enrol_url`, shows the broker fingerprint on Plymouth, polls `/status`,
-and writes the leaf cert to NV `0x01800001`. The dracut hook `tpm-enrol.sh`
+and writes the leaf cert to NV `0x01800100`. The dracut hook `tpm-enrol.sh`
 (initqueue/settled prio 25) is now a thin GATE: empty-NV check (`tpm2_nvread`,
 still needed for the secure-path read) → pre-auth DHCP on `en*` (nmcli override of
 the secure-mode unmanaged drop-in) → `exec /usr/sbin/fleet-enrol` → reboot to
@@ -1071,7 +1071,7 @@ have their EK there), so enrolment could never create our key.
     **`0x81000100`** (non-reserved owner handle; threaded through `fleet-enrol
     -handle` default, `rd.dot1x.handle=` cmdline knob baked by `extract-artifacts.sh`,
     `wpa_supplicant-dot1x.conf`, the bench scripts, invariant #1, and the design docs).
-    NV `0x01800001` (owner range) is unchanged.
+    NV index was `0x01800001` here (owner range); it MOVED to `0x01800100` in a later finding (OEM platform-NV collision on the 820 — see below).
   - **EnsureKey hardening:** (i) evicts a genuine *stale signing key* at the handle
     and recreates (self-heal for old provisioning leftovers); (ii) **refuses to evict
     any restricted-decrypt object (EK/SRK)** as a safety net — never clobber the TPM's
@@ -1096,7 +1096,7 @@ have their EK there), so enrolment could never create our key.
 
 **FOLLOW-UP HARDENING:**
 - **Content-aware NV presence check — BUILT 2026-07-03.** `fleet-enrol -check-only`
-  (no network / no key-gen) reads NV `0x01800001` via `tpmkey.ReadNVCert`, parses it as
+  (no network / no key-gen) reads NV `0x01800100` via `tpmkey.ReadNVCert`, parses it as
   X.509, checks the validity window, and — when a real fleet CA is bundled (`-cacert`,
   default `radius-ca.pem`) — verifies it **chains** to it. Only a valid fleet cert counts
   as enrolled (rc 0); empty/garbage/foreign/expired → rc 20 (enrol + overwrite;
@@ -1109,10 +1109,30 @@ have their EK there), so enrolment could never create our key.
   Tests: `classifyNVCert` unit table (valid/expired/garbage/foreign/no-CA) + `simtest`
   ReadNVCert roundtrip across the 512B chunk. **BENCH-VERIFY** on a real boot: a garbage/
   foreign NV now enrols instead of "normal boot".
-- **De-enrol / TPM-reset procedure** for re-testing: `tpm2_nvundefine 0x01800001 -C o`
+- **De-enrol / TPM-reset procedure** for re-testing: `tpm2_nvundefine 0x01800100 -C o`
   (+ `tpm2_evictcontrol -C o -c 0x81000100` for a stale *app* key — never the EK), or
   BIOS "Clear TPM". Document in the bench README.
 
+**BENCH FINDING 2026-07-03 (FIXED) — NV index `0x01800001` collided with OEM
+platform NV; moved to `0x01800100`.** The Dell 820 kept "finding a cert" and
+bypassing enrolment even after repeated BIOS TPM clears. `tpm2_nvreadpublic`
+showed the truth: `0x01800001` on that hardware is a **firmware/platform** index
+(`platformcreate|policydelete|writelocked`, 70 bytes — NOT our cert; siblings at
+`0x01800003/4` + `0x01810000` share it), which **no owner/BIOS clear can remove**
+(`TPM2_Clear` spares `platformcreate`; `policydelete` needs the platform's secret
+policy). So our chosen index was permanently occupied by Dell — the blind check
+false-positived on it, and even the content-aware check would have failed at the
+NV **write** (can't undefine a platform index). Same class as the EK-handle
+collision. Fix: **moved the NV cert index default `0x01800001` → `0x01800100`**
+(free on the 820; owner range; overridable via `rd.dot1x.nvindex=`), threaded
+through the cmdline (`extract-artifacts.sh`), `fleet-enrol -nvindex`, the dracut
+hooks, bench scripts, invariant #1, and docs. Also **hardened `WriteNVCert`** to
+refuse a `platformcreate` index with a clear "pick a free owner index" error
+instead of a confusing undefine failure (regression `simtest/
+TestWriteNVCertRefusesPlatformIndex`). **BENCH-VERIFY:** 820 now enrols at
+`0x01800100`; and check `tpm2_nvreadpublic` on any OTHER hardware model in the
+fleet — if a vendor also squats `0x018001xx`, pick a value free on all of them.
+
 **BENCH-VERIFY (host side, before trusting):** (a) go-tpm against a REAL TPM +
 swtpm on the target (the simulator proves the ceremony, not the device) — **the
 stale-key fix (above) is the first real-TPM result; re-boot to confirm it now
@@ -1159,7 +1179,7 @@ Verification found + fixed two things the `mock` path had hidden:
   FreeRADIUS (next, before host enrolment).
 
 How a host gets its **802.1X EAP-TLS client identity** the first time — the key at
-TPM handle `0x81000100` + cert at NV `0x01800001` that invariant #1 says must come
+TPM handle `0x81000100` + cert at NV `0x01800100` that invariant #1 says must come
 from enrolment, never the image. Distinct from #10 (that enrols *Secure Boot*
 PK/KEK/db); this enrols the *network identity*. They share the provisioning UKI +
 isolated-environment vehicle. Pairs with #8 + the CA decision (start **step-ca**,
@@ -1170,7 +1190,7 @@ on an empty TPM the host generates a key *in* the TPM, builds a CSR, submits it
 an enrolment **broker**, and shows a **fingerprint** on the Plymouth splash; an
 admin visually cross-checks that fingerprint against the broker's pending-list and
 approves; the broker has step-ca sign the CSR and returns the cert; the host writes
-it to NV `0x01800001` and proceeds to authenticate. Sound, recognised pattern
+it to NV `0x01800100` and proceeds to authenticate. Sound, recognised pattern
 (SSH/WireGuard/Signal-style OOB verification); good fit for invariant #1.
 
 **Key design decisions (settled 2026-06-22):**