fleet-manager: fix CA install, add register-host, surface agent status

Four fixes from the on-host agent bring-up:

1. Bake the real fleet CA into the image. New `fleet_ca` build var (default =
   the committed placeholder) file-provisions the trust anchor to
   /etc/dot1x/radius-ca.pem — used by wpa_supplicant (RADIUS) AND the fleet-agent
   (verify the manager). CI materializes a FLEET_CA secret to a runner-temp file
   and passes -var fleet_ca; unset => placeholder (lab). No CA material committed.

2. server-pki.sh installs the agent CLIENT CA as root+intermediate (not root
   only). Host TPM certs are leaf-only in NV and signed by the step-ca
   intermediate, so a root-only client CA makes the manager advertise only the
   root in its CertificateRequest -> Go clients send no cert ("tls: certificate
   required") and it couldn't verify a leaf-only cert anyway. bootstrap.sh now
   exports intermediate_ca.crt so FLEET_CA_INTERMEDIATE resolves.

3. New `fleet-manager register-host <serial> [-name] [-hostnqn]` subcommand:
   seeds/updates an inventory record for a host enrolled out of band (bench
   broker, migrated fleet) through the real store, so its agent stream is
   accepted. The manual counterpart to the authorise-approve flow.

4. The agent surfaces the authoritative recv-side gRPC status instead of the
   bare io.EOF gRPC returns on the send side when the server ends the stream —
   so "host is not enrolled" (PermissionDenied) shows up instead of "EOF".

diskless.pkr.hcl

@@ -173,6 +173,12 @@ variable "sb_cert" {
   default     = ""
 }
 
+variable "fleet_ca" {
+  type        = string
+  description = "Path on the BUILD HOST to the fleet CA PEM baked to /etc/dot1x/radius-ca.pem — the trust anchor wpa_supplicant uses for RADIUS EAP-TLS AND the fleet-agent uses to verify the fleet-manager. Defaults to the COMMITTED PLACEHOLDER (files/etc/dot1x/radius-ca.pem), which is NOT a usable CA (auth/telemetry can't succeed with it). Override per-environment (CI secret -> temp file) with your real step-ca root (or a root+intermediate bundle for robustness). Never commit real internal CA material (CLAUDE.md)."
+  default     = "files/etc/dot1x/radius-ca.pem"
+}
+
 # --------------------------------------------------------------------- source
 
 source "qemu" "diskless" {
@@ -237,6 +243,15 @@ build {
     destination = "/tmp/etc-stage"
   }
 
+  # Fleet CA baked to /etc/dot1x/radius-ca.pem (RADIUS trust anchor + fleet-agent
+  # server-verify CA). var.fleet_ca defaults to the committed placeholder; CI
+  # overrides it with the real per-environment step-ca root (a build-host path).
+  # Installed over the placeholder in the etc-install step below.
+  provisioner "file" {
+    source      = var.fleet_ca
+    destination = "/tmp/fleet-ca.pem"
+  }
+
   # Kiosk unit + session wrapper (installed by the kiosk provisioner below).
   # Dir-without-trailing-slash upload -> /tmp/kiosk/ (mirrors the dracut module
   # upload form, which stages reliably).
@@ -368,7 +383,10 @@ build {
       "rm -rf /tmp/plymouth",
 
       # Stage etc files into place
-      "install -D -m0644 /tmp/etc-stage/dot1x/radius-ca.pem            /etc/dot1x/radius-ca.pem",
+      # radius-ca.pem comes from var.fleet_ca (placeholder by default; real fleet CA
+      # per-environment via CI) — NOT the etc-stage copy, so one build input controls
+      # the trust anchor for both RADIUS EAP-TLS and the fleet-agent.
+      "install -D -m0644 /tmp/fleet-ca.pem                             /etc/dot1x/radius-ca.pem",
       "install -D -m0644 /tmp/etc-stage/dot1x/wpa_supplicant-dot1x.conf /etc/dot1x/wpa_supplicant-dot1x.conf",
       "install -D -m0644 /tmp/etc-stage/dracut.conf.d/90-diskless.conf  /etc/dracut.conf.d/90-diskless.conf",
       # NB: the old static /etc/NetworkManager/conf.d/99-dot1x-unmanaged.conf is