fleet-manager: fix CA install, add register-host, surface agent status

Four fixes from the on-host agent bring-up:

1. Bake the real fleet CA into the image. New `fleet_ca` build var (default =
   the committed placeholder) file-provisions the trust anchor to
   /etc/dot1x/radius-ca.pem — used by wpa_supplicant (RADIUS) AND the fleet-agent
   (verify the manager). CI materializes a FLEET_CA secret to a runner-temp file
   and passes -var fleet_ca; unset => placeholder (lab). No CA material committed.

2. server-pki.sh installs the agent CLIENT CA as root+intermediate (not root
   only). Host TPM certs are leaf-only in NV and signed by the step-ca
   intermediate, so a root-only client CA makes the manager advertise only the
   root in its CertificateRequest -> Go clients send no cert ("tls: certificate
   required") and it couldn't verify a leaf-only cert anyway. bootstrap.sh now
   exports intermediate_ca.crt so FLEET_CA_INTERMEDIATE resolves.

3. New `fleet-manager register-host <serial> [-name] [-hostnqn]` subcommand:
   seeds/updates an inventory record for a host enrolled out of band (bench
   broker, migrated fleet) through the real store, so its agent stream is
   accepted. The manual counterpart to the authorise-approve flow.

4. The agent surfaces the authoritative recv-side gRPC status instead of the
   bare io.EOF gRPC returns on the send side when the server ends the stream —
   so "host is not enrolled" (PermissionDenied) shows up instead of "EOF".

serving/fleet-manager/server-pki.sh

@@ -29,6 +29,7 @@ OUT=${OUT:-./pki/agent}
 AGENT_SANS=${AGENT_SANS:-diskless-server.bitasylum.org}
 FLEET_CA_URL=${FLEET_CA_URL:-https://ca.fleet.lab:8443}
 FLEET_CA_ROOT=${FLEET_CA_ROOT:-../dot1x-bench/pki/root_ca.crt}
+FLEET_CA_INTERMEDIATE=${FLEET_CA_INTERMEDIATE:-../dot1x-bench/pki/intermediate_ca.crt}
 STEP_PROVISIONER=${STEP_PROVISIONER:-enrol}
 STEP_PROVISIONER_PASSWORD_FILE=${STEP_PROVISIONER_PASSWORD_FILE:-../dot1x-bench/pki/stepca/secrets/password}
 CERT_NOT_AFTER=${CERT_NOT_AFTER:-8760h}
@@ -39,9 +40,6 @@ command -v step >/dev/null || { echo "error: 'step' CLI not found (smallstep/cli
 
 mkdir -p "$OUT"
 
-# The fleet root doubles as the agent-plane CLIENT CA (verifies host TPM certs).
-cp "$FLEET_CA_ROOT" "$OUT/fleet-ca.crt"
-
 # First SAN is the CN; every SAN (DNS name / IP) hosts might dial goes in --san.
 primary=${AGENT_SANS%%,*}
 san_args=()
@@ -60,6 +58,30 @@ step ca certificate "$primary" "$OUT/server.crt" "$OUT/server.key" \
 
 chmod 600 "$OUT/server.key"
 
+# fleet-ca.crt = the agent-plane CLIENT CA that verifies host TPM identity certs.
+# Host certs are stored LEAF-ONLY in TPM NV and are signed by the step-ca
+# INTERMEDIATE, so this MUST be root + intermediate. Root-only fails two ways:
+# (1) the manager can't build leaf->intermediate->root, and (2) it advertises only
+# the root in its TLS CertificateRequest, so a Go client whose leaf is issued by
+# the intermediate sends NO cert at all ("remote error: tls: certificate
+# required"). Prefer an explicit intermediate file; else pull it from the chain
+# step wrote into the just-issued server.crt (every cert after the leaf).
+intermediate=""
+if [ -f "$FLEET_CA_INTERMEDIATE" ]; then
+    intermediate=$(cat "$FLEET_CA_INTERMEDIATE")
+else
+    intermediate=$(awk 'BEGIN{c=0} /-----BEGIN CERTIFICATE-----/{c++} c>1' "$OUT/server.crt")
+fi
+{
+    [ -n "$intermediate" ] && printf '%s\n' "$intermediate"
+    cat "$FLEET_CA_ROOT"
+} > "$OUT/fleet-ca.crt"
+if [ -z "$intermediate" ]; then
+    echo "WARNING: no intermediate CA found (set FLEET_CA_INTERMEDIATE, or the CA has none) —" >&2
+    echo "         fleet-ca.crt is ROOT-ONLY; leaf-only host certs issued by an intermediate" >&2
+    echo "         will fail mTLS with 'tls: certificate required'." >&2
+fi
+
 echo
 echo "done. staged in $OUT :"
 echo "  server.crt / server.key   -> FLEET_MGR_AGENT_CERT / _KEY"