pki: the StarshipOS Root CA's certificate, public, in the tree (#126) [skip ci]

ci/pki/starshipos-root-ca.pem, made on the CI box by make-ca.sh
(2026-11-07, Ed25519, to 2046-11-07; Captain Bob), and its SHA-256
DA:A7:40:56:65:41:1A:FE:E6:08:85:3F:6E:AD:83:3A:38:30:83:E6:F0:6D:69:A6:A8:9E:92:BD:85:93:39:81
in starshipos-root-ca.sha256. Verified: self-signed, CA:TRUE, and it issued
capsules/pki/starshipos-intermediate.der (openssl verify: OK). Every
release attaches it (gitea-release), and the Downloads page shows its
fingerprint; it is also the anchor #139 would build into the kernel.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

ci/pki/make-ca.sh

@@ -3,7 +3,10 @@
 # 2026-11-07: "New root CA on the CI box. Valid StarshipOS rather than snake oil intermediate").
 #
 #   StarshipOS Root CA              Ed25519, 20 years, self-signed. Its key never leaves this box:
-#                                   not in the repository, not in Gitea, not in any image.
+#                                   not in the repository, not in Gitea, not in any image. Its
+#                                   certificate (public) is ci/pki/starshipos-root-ca.pem, made on
+#                                   2026-11-07, SHA-256 in starshipos-root-ca.sha256; every release
+#                                   attaches it.
 #   StarshipOS Capsule Signing      Ed25519, 10 years, signed by the root; CA:TRUE, pathlen:0.
 #                                   Its certificate is built into every image (capsules/pki/
 #                                   starshipos-intermediate.der) and checks each capsule at boot;