fleet-manager: fix CA install, add register-host, surface agent status

Four fixes from the on-host agent bring-up:

1. Bake the real fleet CA into the image. New `fleet_ca` build var (default =
   the committed placeholder) file-provisions the trust anchor to
   /etc/dot1x/radius-ca.pem — used by wpa_supplicant (RADIUS) AND the fleet-agent
   (verify the manager). CI materializes a FLEET_CA secret to a runner-temp file
   and passes -var fleet_ca; unset => placeholder (lab). No CA material committed.

2. server-pki.sh installs the agent CLIENT CA as root+intermediate (not root
   only). Host TPM certs are leaf-only in NV and signed by the step-ca
   intermediate, so a root-only client CA makes the manager advertise only the
   root in its CertificateRequest -> Go clients send no cert ("tls: certificate
   required") and it couldn't verify a leaf-only cert anyway. bootstrap.sh now
   exports intermediate_ca.crt so FLEET_CA_INTERMEDIATE resolves.

3. New `fleet-manager register-host <serial> [-name] [-hostnqn]` subcommand:
   seeds/updates an inventory record for a host enrolled out of band (bench
   broker, migrated fleet) through the real store, so its agent stream is
   accepted. The manual counterpart to the authorise-approve flow.

4. The agent surfaces the authoritative recv-side gRPC status instead of the
   bare io.EOF gRPC returns on the send side when the server ends the stream —
   so "host is not enrolled" (PermissionDenied) shows up instead of "EOF".

serving/fleet-manager/cli.go

@@ -163,3 +163,81 @@ func runRegisterAdmin(args []string) int {
 	fmt.Printf("Enrolment link for %q (valid %s) — open on the mgmt network, then tap the YubiKey:\n\n  %s/#/enrol?token=%s\n\n", name, ttl.String(), base, tok)
 	return 0
 }
+
+// runRegisterHost implements:
+//
+//	fleet-manager register-host [-name S] [-hostnqn N] [-inventory F] <cert-serial-hex>
+//
+// It seeds or updates an inventory record for a host enrolled OUT OF BAND (the
+// standalone bench broker, or a manager inheriting an existing fleet), so the
+// agent stream — which the manager refuses for an unknown serial (agent.go
+// "host is not enrolled") — is accepted. Normally the record is born by the
+// authorise-approve flow; this is the manual import path. It writes through the
+// real jsonStore (atomic save), so it must point at the SAME inventory file the
+// service uses (FLEET_MGR_INVENTORY, default /data in the container). Run it via
+// `docker compose run --rm fleet-manager register-host ...`.
+func runRegisterHost(args []string) int {
+	fs := flag.NewFlagSet("register-host", flag.ContinueOnError)
+	name := fs.String("name", "", "starship name (dnsmasq fleet-namer join; advisory)")
+	inv := fs.String("inventory", env("FLEET_MGR_INVENTORY", "/var/lib/fleet-manager/inventory.json"), "inventory file (must match the service's FLEET_MGR_INVENTORY)")
+	nqn := fs.String("hostnqn", "", "host NQN (default: $HOSTNQN_BASE + serial)")
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+	serial := strings.ToLower(strings.TrimSpace(fs.Arg(0)))
+	if !isHexSerial(serial) {
+		fmt.Fprintln(os.Stderr, "usage: fleet-manager register-host [-name S] [-hostnqn N] [-inventory F] <cert-serial-hex>")
+		return 2
+	}
+
+	store, err := newJSONStore(*inv)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "inventory %s: %v\n", *inv, err)
+		return 1
+	}
+	hostnqn := *nqn
+	if hostnqn == "" {
+		hostnqn = env("HOSTNQN_BASE", "nqn.2026-06.org.example.fleet:host-") + serial
+	}
+	now := time.Now().UTC()
+
+	h, existed := store.Get(serial)
+	if !existed {
+		h = &Host{Identity: Identity{CertSerial: serial}, FirstSeen: now}
+	}
+	h.Identity.CertSerial = serial
+	h.Identity.Hostnqn = hostnqn
+	if *name != "" {
+		h.Identity.StarshipName = *name
+	}
+	if h.Enrolled.At.IsZero() {
+		h.Enrolled = Enrolled{Approver: "register-host CLI", At: now}
+	}
+	h.LastSeen = now
+
+	if err := store.Upsert(h); err != nil {
+		fmt.Fprintf(os.Stderr, "write inventory %s: %v\n", *inv, err)
+		return 1
+	}
+	verb := "registered"
+	if existed {
+		verb = "updated"
+	}
+	fmt.Printf("%s host %s (starship=%q hostnqn=%s) in %s\n", verb, serial, h.Identity.StarshipName, hostnqn, *inv)
+	return 0
+}
+
+// isHexSerial reports whether s is a non-empty lowercase-hex cert serial (the
+// inventory key form). Serials can be odd-length hex (big-int %x), so we validate
+// characters rather than decoding.
+func isHexSerial(s string) bool {
+	if s == "" {
+		return false
+	}
+	for _, c := range s {
+		if !((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f')) {
+			return false
+		}
+	}
+	return true
+}