pki: the StarshipOS CA, made on the CI box; capsules signed in CI

Ruled by Captain Bob, 2026-11-07: "New root CA on the CI box. Valid
StarshipOS rather than snake oil intermediate."

- ci/pki/make-ca.sh makes the StarshipOS Root CA (its key stays on the CI
  box) and the StarshipOS Capsule Signing intermediate it issues, and
  stores the signing key as the secret CAPSULE_SIGN_KEY.
- The kernel finds the signing certificate by one name,
  CAPSULE_SIGNING_CERT_NAME = pki:starshipos-intermediate.der. The
  certificate itself lands once make-ca.sh has run; until then the
  snakeoil intermediate is in the tree under its old name and the
  capsules check as "no root key" (a warning, as "missing" was).
- mkcapsule refuses a signing key that is not that certificate's.
- SIGN_KEY has no default; acceptance, build, nightly and release set it
  from the secret.

FABRIC-3.md XLVI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

kernel/include/starkernel/x509_ed25519.h

@@ -6,9 +6,10 @@
  *
  * x509_extract_ed25519_pubkey() only ever reads SubjectPublicKeyInfo --
  * no signature verification, no chain validation, no extension parsing.
- * That's the capsule-PKI use case (Milestone 6): the embedded snakeoil
- * intermediate cert is trusted because it's baked into the trusted build,
- * never re-verified against the offline root CA at boot.
+ * That's the capsule-PKI use case (Milestone 6): the embedded capsule-
+ * signing cert (StarshipOS Capsule Signing since 2026-11-07, the snakeoil
+ * intermediate before it) is trusted because it's baked into the trusted
+ * build, never re-verified against its root CA at boot.
  *
  * x509_verify_signature()/x509_extract_serial() (added 2026-08-28,
  * FABRIC-2.md §F.7/§F.17) are for CERTVERIFY -- a regular user's cert,