pki: the StarshipOS CA, made on the CI box; capsules signed in CI

Ruled by Captain Bob, 2026-11-07: "New root CA on the CI box. Valid
StarshipOS rather than snake oil intermediate."

- ci/pki/make-ca.sh makes the StarshipOS Root CA (its key stays on the CI
  box) and the StarshipOS Capsule Signing intermediate it issues, and
  stores the signing key as the secret CAPSULE_SIGN_KEY.
- The kernel finds the signing certificate by one name,
  CAPSULE_SIGNING_CERT_NAME = pki:starshipos-intermediate.der. The
  certificate itself lands once make-ca.sh has run; until then the
  snakeoil intermediate is in the tree under its old name and the
  capsules check as "no root key" (a warning, as "missing" was).
- mkcapsule refuses a signing key that is not that certificate's.
- SIGN_KEY has no default; acceptance, build, nightly and release set it
  from the secret.

FABRIC-3.md XLVI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

kernel/include/starkernel/capsule_sig.h

@@ -22,6 +22,12 @@
 
 #include "starkernel/capsule.h"
 
+/* The certificate whose key the capsules are signed with: "StarshipOS
+ * Capsule Signing", issued by the StarshipOS Root CA (ci/pki/make-ca.sh;
+ * FABRIC-3.md XLVI), replacing the snakeoil intermediate of Milestone 6.
+ * mkcapsule refuses to sign with a key that is not this certificate's. */
+#define CAPSULE_SIGNING_CERT_NAME "pki:starshipos-intermediate.der"
+
 typedef enum {
     CAPSULE_SIG_OK = 0,       /* has_sig=1, and it verifies */
     CAPSULE_SIG_MISSING,      /* has_sig=0 -- not signed at all */
@@ -31,9 +37,9 @@ typedef enum {
 
 /*
  * Verify capsule descs[index]'s Ed25519 signature against the embedded
- * snakeoil intermediate cert's public key (capsule name
- * "pki:snakeoil-intermediate.der", found and parsed once, cached for
- * every later call this boot -- the cert doesn't change mid-boot).
+ * capsule-signing certificate's public key (CAPSULE_SIGNING_CERT_NAME,
+ * found and parsed once, cached for every later call this boot -- the
+ * cert doesn't change mid-boot).
  *
  * descs/names/sigs must be the same three parallel arrays
  * (capsule_get_descriptors()/capsule_get_names()/capsule_get_signatures()),