tpm-enrol: inline empty-NV first-boot enrolment (host side, TODO #11)

Builds the host side of TPM identity enrolment — the "inline single-UKI"
vehicle from docs/tpm-enrolment-design.md. A production (secure) UKI now
auto-enrols a fresh host with no client cert, then reboots into the normal
secure path.

New dracut hook files/dracut/95dot1x-macsec/tpm-enrol.sh (initqueue/settled
prio 25, BEFORE dot1x-macsec-up at 30):
  - no-op when a cert is already present in NV 0x01800001 (normal boot) or
    under rd.dot1x=0 (test path has no trustworthy identity to enrol);
  - on EMPTY NV: generate the signing key in the TPM @0x81010001 (openssl tpm2
    provider builds the CSR; key never leaves the TPM), pre-auth DHCP on the
    PHYSICAL NIC (nmcli re-manages en*, overriding the secure-mode unmanaged
    drop-in), POST CSR+context to rd.fleet.enrol_url, show the broker
    fingerprint on Plymouth, poll /status, write the issued leaf cert (DER) to
    NV, and reboot to converge.
  - Empty-NV and the secure path are mutually exclusive, so this never reorders
    the load-bearing boot sequence (invariant #2).

Wiring:
  - module-setup.sh: require+install the tpm2 key-gen/NV tools, curl, awk, and
    the openssl tpm2 PROVIDER (ossl-modules/tpm2.so, asserted present — tpm2-tss
    alone can't sign with a handle: key); install the hook.
  - diskless.pkr.hcl: install tpm2-openssl + curl; assert hook/tools/provider in
    the initramfs (invariant #9). New enrol_url var threaded to extract-artifacts.
  - extract-artifacts.sh: bake rd.fleet.enrol_url into the cmdline.
  - fleet.script: enrol-active/enrol-wait/enrol-done banner; fingerprint on the
    message line (public — states only, invariant #1).

Shell JSON build/parse/cert-extract pipeline (no jq in the initramfs) verified
end-to-end against a live broker. BENCH-VERIFY list in docs/TODO.md #11 (tpm2
provider key-ref on real/swtpm, empty-NV detect, pre-auth DHCP override, Plymouth
render, NV write + reboot convergence, prod HTTPS).

docs/TODO.md

@@ -999,9 +999,34 @@ store, per-IP rate limit; signs via `step` (dev `mock` signer). Ships in
 `serving/dot1x-bench/docker-compose.yml`; end-to-end smoke-tested (CSR → mTLS
 approve → cert). **BENCH-VERIFY:** run against real step-ca (`bootstrap.sh` root +
 `enrol` provisioner password readable by the broker) and confirm an issued cert
-authenticates EAP-TLS. **REMAINING:** the host-side inline empty-NV dracut branch
-(generate key/CSR → POST → Plymouth fingerprint → poll → NV write → reboot) +
-`tpm2-openssl` in the image.
+authenticates EAP-TLS.
+
+**HOST SIDE BUILT 2026-07-02 (inline empty-NV branch) — awaiting bench.** New
+dracut hook `files/dracut/95dot1x-macsec/tpm-enrol.sh` (initqueue/settled prio 25,
+BEFORE dot1x-macsec-up at 30): on a secure build with an EMPTY NV `0x01800001` it
+generates the TPM key at `0x81010001`, builds a CSR via the openssl tpm2 provider,
+does a **pre-auth DHCP on the physical NIC** (re-manages `en*` via nmcli, overriding
+the secure-mode unmanaged drop-in), POSTs CSR+context to `rd.fleet.enrol_url`
+(default `http://boot.fleet.lab/enrol`), shows the broker fingerprint on Plymouth
+(`enrol-*` tokens + message line), polls `/status`, writes the issued leaf cert
+(DER) to NV, and **reboots into the secure path**. No-op when a cert is already
+present (normal boot) or under `rd.dot1x=0`. Wiring: `module-setup.sh`
+require+install the tpm2 key-gen tools + curl + the **openssl tpm2 provider**
+(`ossl-modules/tpm2.so`, asserted present); `diskless.pkr.hcl` installs
+`tpm2-openssl`+`curl` and asserts hook/tools/provider in the initramfs; new
+`enrol_url` Packer var → `rd.fleet.enrol_url` cmdline (extract-artifacts.sh). The
+shell JSON build/parse/cert-extract pipeline (no jq in initramfs) was verified
+against a live broker end-to-end.
+
+**BENCH-VERIFY (host side, before trusting):** (a) openssl tpm2 provider `handle:`
+key ref actually signs the CSR on the target (swtpm + real TPM) — the CLAUDE.md
+provider-vs-pkcs11 caveat; (b) empty-NV detection + the create/persist path on a
+truly-fresh TPM (owner auth empty); (c) pre-auth DHCP on `en*` in secure mode (the
+`nmcli device set managed yes` runtime override of nm-unmanaged.sh actually
+manages+leases the NIC); (d) the fingerprint renders on the `fleet` Plymouth theme
++ the admin can match it; (e) NV write succeeds (TPM owner auth) and the **reboot
+converges** — 2nd boot finds the cert and runs the secure path; (f) prod: the
+broker endpoint over **HTTPS** (curl `--cacert radius-ca.pem`), currently lab-HTTP.
 
 **TEMPORARY (2026-06-28): broker also added to the MAIN serving stack**
 (`serving/docker-compose.yml`, `enrol-broker` service + `ENROL_*` in

docs/tpm-enrolment-design.md

@@ -322,9 +322,14 @@ exists. Enrolment is where it comes into being.
    **dedicated** CA (`admin-pki.sh`), separate from the fleet CA, so host certs
    can't authenticate to the admin plane. End-to-end smoke-tested (CSR → mTLS
    approve → cert; pubkey match). Ships in `serving/dot1x-bench/docker-compose.yml`.
-3. **Host side (next build):** the **inline empty-NV trigger** — dracut early-boot
-   branch that generates key/CSR, POSTs to the broker, shows the fingerprint on
-   Plymouth, polls, writes NV, reboots; plus `tpm2-openssl` in the image.
+3. **Host side — BUILT 2026-07-02 (awaiting bench):** the **inline empty-NV
+   trigger** — dracut hook `95dot1x-macsec/tpm-enrol.sh` (initqueue/settled prio
+   25) generates key/CSR (openssl tpm2 provider), pre-auth-DHCPs the physical NIC,
+   POSTs to the broker, shows the fingerprint on Plymouth, polls, writes the leaf
+   cert to NV `0x01800001`, and reboots into the secure path. No-op when a cert is
+   already present or under `rd.dot1x=0`. Ships `tpm2-openssl`+`curl` in the image
+   (asserted in the initramfs); `enrol_url` Packer var → `rd.fleet.enrol_url`.
+   BENCH-VERIFY list in `docs/TODO.md` #11.
 4. **Folds into fleet-manager:** the admin routes become the mgmt service's
    authenticated plane; approval writes the shared inventory record.
 5. **Provisioning-UKI variant** (`enrol_mode`) — move enrolment out of the production