fleet-enrol: content-aware NV check (-check-only), not blind "index defined"

The enrol trigger keyed on "is NV 0x01800001 defined/readable", so leftover
state (an earlier tpm-provision run — bench-seen on the 820: "cert present —
normal boot" with no real identity) or random bytes (tpm-selftest) silently
suppressed enrolment. Now content-aware:

- tpmkey.ReadNVCert reads the full NV contents (chunked).
- classifyNVCert (TPM-agnostic, unit-tested): parses X.509, checks validity
  window, and when a real fleet CA bundle is present verifies the cert chains
  to it. Only a valid fleet cert = enrolled.
- New `fleet-enrol -check-only` (no network/no key-gen) exits 0=valid cert,
  20=enrol needed, 1=error. The full enrol path uses the same classification
  instead of NVPresent.
- The dracut hook calls -check-only as the single gate, replacing the blind
  tpm2_nvread (and its now-dead TPM2TOOLS_TCTI export). tpm2_nvread stays in
  the initramfs for the secure path (dot1x-macsec-up.sh).

Lab fallback: the shipped radius-ca.pem is a placeholder (not a cert) ->
loadCAPool returns nil -> chain-less "parseable + unexpired" acceptance, so
reboot-converge doesn't loop; production replaces radius-ca.pem with the real
fleet CA for strict chaining.

Tests: classifyNVCert table (valid/expired/garbage/foreign/no-CA) + simtest
ReadNVCert roundtrip across the 512B chunk. All pass; packer validate clean.

files/enrol/tpmkey/tpmkey.go

@@ -178,13 +178,47 @@ func EnsureKey(tpm transport.TPM, handle tpm2.TPMHandle) (signer *Signer, create
 	return s, true, err
 }
 
-// nvPresent reports whether a defined NV index exists (our enrol NV is defined
-// and written atomically, so "defined" means "has a cert").
+// nvPresent reports whether a defined NV index exists. NOTE: "defined" does NOT
+// mean "holds our fleet cert" — leftover/foreign NV (e.g. an earlier
+// tpm-provision run, or another OS) also reports present. Prefer ReadNVCert +
+// content validation for the enrol decision; this stays for cheap existence checks.
 func NVPresent(tpm transport.TPM, index tpm2.TPMHandle) bool {
 	_, err := (tpm2.NVReadPublic{NVIndex: index}).Execute(tpm)
 	return err == nil
 }
 
+// ReadNVCert reads the full contents of NV index (chunked under the NV buffer
+// limit). Returns an error if the index is undefined or unreadable — callers
+// treat that as "no cert" (enrol). The bytes are the caller's to parse/validate;
+// this does not assume they are a certificate.
+func ReadNVCert(tpm transport.TPM, index tpm2.TPMHandle) ([]byte, error) {
+	rp, err := (tpm2.NVReadPublic{NVIndex: index}).Execute(tpm)
+	if err != nil {
+		return nil, fmt.Errorf("nv readpublic: %w", err)
+	}
+	pub, err := rp.NVPublic.Contents()
+	if err != nil {
+		return nil, err
+	}
+	size := int(pub.DataSize)
+	out := make([]byte, 0, size)
+	const chunk = 512 // conservatively under TPM_MAX_NV_BUFFER_SIZE
+	for off := 0; off < size; off += chunk {
+		end := min(off+chunk, size)
+		r, err := (tpm2.NVRead{
+			AuthHandle: tpm2.AuthHandle{Handle: index, Name: rp.NVName, Auth: tpm2.PasswordAuth(nil)},
+			NVIndex:    tpm2.NamedHandle{Handle: index, Name: rp.NVName},
+			Size:       uint16(end - off),
+			Offset:     uint16(off),
+		}).Execute(tpm)
+		if err != nil {
+			return nil, fmt.Errorf("nv read @%d: %w", off, err)
+		}
+		out = append(out, r.Data.Buffer...)
+	}
+	return out, nil
+}
+
 // nvWriteCert (re)defines the NV index sized to der and writes it under owner
 // auth. Chunks the write to stay within the TPM's NV buffer limit.
 func WriteNVCert(tpm transport.TPM, index tpm2.TPMHandle, der []byte) error {