pki: the StarshipOS CA, made on the CI box; capsules signed in CI

Ruled by Captain Bob, 2026-11-07: "New root CA on the CI box. Valid
StarshipOS rather than snake oil intermediate."

- ci/pki/make-ca.sh makes the StarshipOS Root CA (its key stays on the CI
  box) and the StarshipOS Capsule Signing intermediate it issues, and
  stores the signing key as the secret CAPSULE_SIGN_KEY.
- The kernel finds the signing certificate by one name,
  CAPSULE_SIGNING_CERT_NAME = pki:starshipos-intermediate.der. The
  certificate itself lands once make-ca.sh has run; until then the
  snakeoil intermediate is in the tree under its old name and the
  capsules check as "no root key" (a warning, as "missing" was).
- mkcapsule refuses a signing key that is not that certificate's.
- SIGN_KEY has no default; acceptance, build, nightly and release set it
  from the secret.

FABRIC-3.md XLVI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

kernel/Makefile

@@ -207,7 +207,8 @@ MKCAPSULE_SRC       = tools/mkcapsule.c tools/pkcs8_ed25519.c \
                       kernel/src/crypto/ed25519.c \
                       kernel/src/crypto/fe25519.c \
                       kernel/src/crypto/scalar25519.c \
-                      kernel/src/crypto/sha512.c
+                      kernel/src/crypto/sha512.c \
+                      kernel/src/crypto/x509_ed25519.c
 MKCAPSULE_BIN       = $(BUILD_DIR)/tools/mkcapsule
 # mkartemis: formats and signs an Artemis partition at build with the kernel's own
 # block-subsystem and artemis_sig code (tools/mkartemis.c), built as v4/Makefile builds them.
@@ -215,12 +216,11 @@ MKARTEMIS_SRC       = tools/mkartemis.c kernel/src/artemis_sig.c \
                       $(addprefix v3/src/,block_subsystem.c blkio_ram.c blkio_file.c log.c \
                                           platform/platform_init.c platform/linux/time.c)
 MKARTEMIS_BIN       = $(BUILD_DIR)/tools/mkartemis
-# Milestone 6 (Phase 8): the snakeoil intermediate's private key, generated
-# offline outside this repo entirely (see FABRIC-2.md's Phase 8 §Milestone 6
-# writeup) -- not present in CI or a fresh checkout, so signing is skipped
-# gracefully ($(wildcard ...) below) rather than failing the build. Override
-# with `make SIGN_KEY=/path/to/key.pem ...` on a machine that holds it.
-SIGN_KEY           ?= /home/rajames/CLionProjects/lithosananke-ca/intermediate/snakeoil-intermediate.key
+# The capsule-signing key: "StarshipOS Capsule Signing"'s private key (ci/pki/make-ca.sh,
+# FABRIC-3.md XLVI). CI sets SIGN_KEY from the secret CAPSULE_SIGN_KEY; elsewhere set it by hand
+# (`make SIGN_KEY=/path/to/signing.key ...`). Unset or absent, the capsules are built unsigned,
+# which boots with a warning per capsule. mkcapsule refuses a key that is not the certificate's.
+SIGN_KEY           ?=
 SIGN_KEY_ARGS       = $(if $(wildcard $(SIGN_KEY)),--sign-key $(SIGN_KEY),)
 CAPSULE_GENERATED   = $(BUILD_DIR)/capsule_generated.c
 CAPSULE_GENERATED_OBJ  = $(BUILD_DIR)/capsule_generated.o