Operator-cert mint. Offline crypto only - never opens a socket. Generates an ECDSA-P-256 keypair, signs a clientAuth-EKU child with the fleet root cert + key, atomic-writes both PEMs.