pki: the StarshipOS CA, made on the CI box; capsules signed in CI

Ruled by Captain Bob, 2026-11-07: "New root CA on the CI box. Valid
StarshipOS rather than snake oil intermediate."

- ci/pki/make-ca.sh makes the StarshipOS Root CA (its key stays on the CI
  box) and the StarshipOS Capsule Signing intermediate it issues, and
  stores the signing key as the secret CAPSULE_SIGN_KEY.
- The kernel finds the signing certificate by one name,
  CAPSULE_SIGNING_CERT_NAME = pki:starshipos-intermediate.der. The
  certificate itself lands once make-ca.sh has run; until then the
  snakeoil intermediate is in the tree under its old name and the
  capsules check as "no root key" (a warning, as "missing" was).
- mkcapsule refuses a signing key that is not that certificate's.
- SIGN_KEY has no default; acceptance, build, nightly and release set it
  from the secret.

FABRIC-3.md XLVI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

kernel/src/capsule/capsule_sig.c

@@ -4,8 +4,6 @@
 #include "starkernel/ed25519.h"
 #include <string.h>
 
-#define SNAKEOIL_CERT_NAME "pki:snakeoil-intermediate.der"
-
 /* Cached once per boot: the cert doesn't change mid-boot, and every
  * capsule birth (Mama, then every child VM) would otherwise re-find and
  * re-parse the same cert. -1 = not yet attempted, 0 = failed, 1 = ready. */
@@ -20,7 +18,7 @@ static int find_and_cache_pubkey(const CapsuleDesc *descs,
 
     pubkey_state = 0; /* assume failure unless every step below succeeds */
     for (uint32_t i = 0; i < desc_count; i++) {
-        if (strcmp(names[i].name, SNAKEOIL_CERT_NAME) == 0) {
+        if (strcmp(names[i].name, CAPSULE_SIGNING_CERT_NAME) == 0) {
             const CapsuleDesc *cert_desc = &descs[i];
             if (x509_extract_ed25519_pubkey(arena_base + cert_desc->offset,
                                              (size_t)cert_desc->length,