fleet-manager: fix CA install, add register-host, surface agent status

Four fixes from the on-host agent bring-up:

1. Bake the real fleet CA into the image. New `fleet_ca` build var (default =
   the committed placeholder) file-provisions the trust anchor to
   /etc/dot1x/radius-ca.pem — used by wpa_supplicant (RADIUS) AND the fleet-agent
   (verify the manager). CI materializes a FLEET_CA secret to a runner-temp file
   and passes -var fleet_ca; unset => placeholder (lab). No CA material committed.

2. server-pki.sh installs the agent CLIENT CA as root+intermediate (not root
   only). Host TPM certs are leaf-only in NV and signed by the step-ca
   intermediate, so a root-only client CA makes the manager advertise only the
   root in its CertificateRequest -> Go clients send no cert ("tls: certificate
   required") and it couldn't verify a leaf-only cert anyway. bootstrap.sh now
   exports intermediate_ca.crt so FLEET_CA_INTERMEDIATE resolves.

3. New `fleet-manager register-host <serial> [-name] [-hostnqn]` subcommand:
   seeds/updates an inventory record for a host enrolled out of band (bench
   broker, migrated fleet) through the real store, so its agent stream is
   accepted. The manual counterpart to the authorise-approve flow.

4. The agent surfaces the authoritative recv-side gRPC status instead of the
   bare io.EOF gRPC returns on the send side when the server ends the stream —
   so "host is not enrolled" (PermissionDenied) shows up instead of "EOF".

.gitea/workflows/gitea-main-ci.yaml

@@ -280,6 +280,22 @@ jobs:
           echo "SB_CERT_FILE=$d/db.crt" >> "$GITHUB_ENV"
           echo "Secure Boot signing material staged (signed UKI build)."
 
+      -
+        name: Materialize fleet CA (radius-ca.pem trust anchor)
+        # The real fleet step-ca root is baked to /etc/dot1x/radius-ca.pem (RADIUS
+        # EAP-TLS + fleet-agent server-verify). Written to a runner-temp FILE and
+        # passed as a build-host PATH (var.fleet_ca). If FLEET_CA is unset this
+        # no-ops and the build falls back to the committed PLACEHOLDER (auth cannot
+        # succeed — lab only). Never commit real internal CA material (CLAUDE.md).
+        if: ${{ secrets.FLEET_CA != '' }}
+        env:
+          FLEET_CA: ${{ secrets.FLEET_CA }}   # fleet step-ca root PEM (root, or root+intermediate)
+        run: |
+          umask 077
+          printf '%s\n' "$FLEET_CA" > "$RUNNER_TEMP/fleet-ca.pem"
+          echo "FLEET_CA_FILE=$RUNNER_TEMP/fleet-ca.pem" >> "$GITHUB_ENV"
+          echo "Fleet CA staged (real trust anchor baked into radius-ca.pem)."
+
       -
         name: Materialize Secure Boot enrollment certs
         # PUBLIC PK/KEK/db .auth files baked into the image for fleet-sb-enroll.
@@ -316,6 +332,7 @@ jobs:
             -var ssh_authorized_key="${{ secrets.SSH_AUTHORIZED_KEY }}" \
             -var sb_key="${SB_KEY_FILE:-}" \
             -var sb_cert="${SB_CERT_FILE:-}" \
+            -var fleet_ca="${FLEET_CA_FILE:-files/etc/dot1x/radius-ca.pem}" \
             -var kiosk_url="${{ env.KIOSK_URL }}" \
             -var boot_splash=${{ env.BOOT_SPLASH }} \
             -var enable_stig=${{ env.ENABLE_STIG }} \