fleet-enrol: content-aware NV check (-check-only), not blind "index defined"

The enrol trigger keyed on "is NV 0x01800001 defined/readable", so leftover
state (an earlier tpm-provision run — bench-seen on the 820: "cert present —
normal boot" with no real identity) or random bytes (tpm-selftest) silently
suppressed enrolment. Now content-aware:

- tpmkey.ReadNVCert reads the full NV contents (chunked).
- classifyNVCert (TPM-agnostic, unit-tested): parses X.509, checks validity
  window, and when a real fleet CA bundle is present verifies the cert chains
  to it. Only a valid fleet cert = enrolled.
- New `fleet-enrol -check-only` (no network/no key-gen) exits 0=valid cert,
  20=enrol needed, 1=error. The full enrol path uses the same classification
  instead of NVPresent.
- The dracut hook calls -check-only as the single gate, replacing the blind
  tpm2_nvread (and its now-dead TPM2TOOLS_TCTI export). tpm2_nvread stays in
  the initramfs for the secure path (dot1x-macsec-up.sh).

Lab fallback: the shipped radius-ca.pem is a placeholder (not a cert) ->
loadCAPool returns nil -> chain-less "parseable + unexpired" acceptance, so
reboot-converge doesn't loop; production replaces radius-ca.pem with the real
fleet CA for strict chaining.

Tests: classifyNVCert table (valid/expired/garbage/foreign/no-CA) + simtest
ReadNVCert roundtrip across the 512B chunk. All pass; packer validate clean.

files/enrol/simtest/tpmsim_test.go

@@ -4,6 +4,7 @@
 package simtest
 
 import (
+	"bytes"
 	"crypto/ecdsa"
 	"crypto/rand"
 	"crypto/sha256"
@@ -85,7 +86,10 @@ func TestNVWriteAndPresence(t *testing.T) {
 	if tpmkey.NVPresent(tpm, nv) {
 		t.Fatalf("NV should be empty on a fresh TPM")
 	}
-	// realistic cert-sized payload that also crosses the 512B write chunk.
+	if _, err := tpmkey.ReadNVCert(tpm, nv); err == nil {
+		t.Fatalf("ReadNVCert should error on an undefined index")
+	}
+	// realistic cert-sized payload that also crosses the 512B read/write chunk.
 	want := make([]byte, 700)
 	rand.Read(want)
 	if err := tpmkey.WriteNVCert(tpm, nv, want); err != nil {
@@ -94,10 +98,21 @@ func TestNVWriteAndPresence(t *testing.T) {
 	if !tpmkey.NVPresent(tpm, nv) {
 		t.Fatalf("NV should be present after write")
 	}
+	// ReadNVCert must return exactly what was written (across the chunk boundary).
+	got, err := tpmkey.ReadNVCert(tpm, nv)
+	if err != nil {
+		t.Fatalf("ReadNVCert: %v", err)
+	}
+	if !bytes.Equal(got, want) {
+		t.Fatalf("ReadNVCert roundtrip mismatch: got %d bytes, want %d", len(got), len(want))
+	}
 	// re-write (re-enrolment) must succeed (undefine + redefine).
 	if err := tpmkey.WriteNVCert(tpm, nv, want[:400]); err != nil {
 		t.Fatalf("WriteNVCert rewrite: %v", err)
 	}
+	if got, _ := tpmkey.ReadNVCert(tpm, nv); !bytes.Equal(got, want[:400]) {
+		t.Fatalf("ReadNVCert after rewrite mismatch: got %d bytes, want 400", len(got))
+	}
 }
 
 // Regression for the bench failure "key at handle is not ECC ... selector value