fleet-manager: fix CA install, add register-host, surface agent status

Four fixes from the on-host agent bring-up:

1. Bake the real fleet CA into the image. New `fleet_ca` build var (default =
   the committed placeholder) file-provisions the trust anchor to
   /etc/dot1x/radius-ca.pem — used by wpa_supplicant (RADIUS) AND the fleet-agent
   (verify the manager). CI materializes a FLEET_CA secret to a runner-temp file
   and passes -var fleet_ca; unset => placeholder (lab). No CA material committed.

2. server-pki.sh installs the agent CLIENT CA as root+intermediate (not root
   only). Host TPM certs are leaf-only in NV and signed by the step-ca
   intermediate, so a root-only client CA makes the manager advertise only the
   root in its CertificateRequest -> Go clients send no cert ("tls: certificate
   required") and it couldn't verify a leaf-only cert anyway. bootstrap.sh now
   exports intermediate_ca.crt so FLEET_CA_INTERMEDIATE resolves.

3. New `fleet-manager register-host <serial> [-name] [-hostnqn]` subcommand:
   seeds/updates an inventory record for a host enrolled out of band (bench
   broker, migrated fleet) through the real store, so its agent stream is
   accepted. The manual counterpart to the authorise-approve flow.

4. The agent surfaces the authoritative recv-side gRPC status instead of the
   bare io.EOF gRPC returns on the send side when the server ends the stream —
   so "host is not enrolled" (PermissionDenied) shows up instead of "EOF".

serving/fleet-manager/main.go

@@ -112,6 +112,13 @@ func main() {
 	if len(os.Args) > 1 && os.Args[1] == "register-admin" {
 		os.Exit(runRegisterAdmin(os.Args[2:]))
 	}
+	// Subcommand: `fleet-manager register-host <serial>` seeds/updates an inventory
+	// record for a host enrolled OUT OF BAND (bench broker, migrated fleet) so its
+	// agent stream is accepted — the manual counterpart to the authorise-approve
+	// flow that normally births the record.
+	if len(os.Args) > 1 && os.Args[1] == "register-host" {
+		os.Exit(runRegisterHost(os.Args[2:]))
+	}
 
 	log.SetFlags(log.LstdFlags | log.LUTC)
 	cfg := loadConfig()