Operator-side helper: mints a clientAuth-EKU X.509 cert from the offline fleet root CA. Pure offline crypto, no network access.