fleet-manager: fix CA install, add register-host, surface agent status

Four fixes from the on-host agent bring-up:

1. Bake the real fleet CA into the image. New `fleet_ca` build var (default =
   the committed placeholder) file-provisions the trust anchor to
   /etc/dot1x/radius-ca.pem — used by wpa_supplicant (RADIUS) AND the fleet-agent
   (verify the manager). CI materializes a FLEET_CA secret to a runner-temp file
   and passes -var fleet_ca; unset => placeholder (lab). No CA material committed.

2. server-pki.sh installs the agent CLIENT CA as root+intermediate (not root
   only). Host TPM certs are leaf-only in NV and signed by the step-ca
   intermediate, so a root-only client CA makes the manager advertise only the
   root in its CertificateRequest -> Go clients send no cert ("tls: certificate
   required") and it couldn't verify a leaf-only cert anyway. bootstrap.sh now
   exports intermediate_ca.crt so FLEET_CA_INTERMEDIATE resolves.

3. New `fleet-manager register-host <serial> [-name] [-hostnqn]` subcommand:
   seeds/updates an inventory record for a host enrolled out of band (bench
   broker, migrated fleet) through the real store, so its agent stream is
   accepted. The manual counterpart to the authorise-approve flow.

4. The agent surfaces the authoritative recv-side gRPC status instead of the
   bare io.EOF gRPC returns on the send side when the server ends the stream —
   so "host is not enrolled" (PermissionDenied) shows up instead of "EOF".

serving/dot1x-bench/step-ca/bootstrap.sh

@@ -71,6 +71,14 @@ FP=$(openssl x509 -in "$PKI/root_ca.crt" -noout -fingerprint -sha256 | cut -d= -
 echo "    root fingerprint: $FP"
 echo "    copy to: files/etc/dot1x/radius-ca.pem  (image trust anchor)"
 
+# Also export the INTERMEDIATE: leaf certs (host TPM identities, RADIUS, the
+# fleet-manager server cert) are signed by it, so the fleet-manager agent-plane
+# CLIENT CA must be root+intermediate (server-pki.sh reads it via
+# FLEET_CA_INTERMEDIATE). Best-effort — a single-tier CA has none.
+incca cp /home/step/certs/intermediate_ca.crt /export/intermediate_ca.crt 2>/dev/null \
+    && echo "    exported intermediate_ca.crt (-> server-pki.sh fleet-ca.crt bundle)" \
+    || echo "    (no intermediate_ca.crt — single-tier CA)"
+
 # --- 1b. raise the CA cert-duration claim (idempotent) ----------------------
 # A stock step-ca caps issued certs at 24h. Both the RADIUS server cert below
 # AND the enrol-broker (--not-after 720h) need longer-lived fleet certs, so the