macos-l4: sysext-owned MITM CA, SE-encrypted, XPC-rotated

[GlenDC]

Container no longer mints or stores the MITM CA. Sysext owns it: minted
in-process, encrypted via Secure Enclave, persisted to the System
Keychain. Hard-fails without SE. Two-phase rotation over XPC, with the
pending CA served via the hijack endpoint so callers can install trust
before the swap.

Pre-PR installs stored the CA in the host's data-protection keychain.
That entry is honored as run-only passthrough until the first commit;
the sysext always prefers an SE-backed CA when one exists.

Rotate the active CA

1. just macos-l4-cli generate-ca-crt — sysext mints a fresh CA,
   parks it as pending, hijack endpoint starts serving it. Active TLS
   stays on the previous CA. Stdout: cert_der_b64: <b64>.
   (can also ofc be retrieved via hijack domain as per usual)
2. Install trust for the new DER (e.g. Go daemon side).
3. just macos-l4-cli commit-ca-crt — persist + atomic swap.
   Retires legacy entries on success. Stdout:
   previous_cert_der_b64: <b64> (empty if nothing displaced).
   Non-zero exit if commit succeeded but legacy cleanup failed — run
   just macos-l4-cli cleanup-legacy-ca-crt to retry.
4. Drop trust for the previous DER.

Move an existing install off legacy

• Next just macos-l4-start forwards legacy via opaque config (run-only); a single
  just macos-l4-cli generate-ca-crt + just macos-l4-cli commit-ca-crt retires it.
• If the SE-backed CA already exists alongside legacy:
  just macos-l4-cli cleanup-legacy-ca-crt retires legacy without touching the active CA.
• just macos-l4-cli delete-ca-crt is the full reset (legacy + SE entries).

Summary by Aikido

Security Issues: 0	🔍 Quality Issues: 6	Resolved Issues: 0

🚀 New Features

• Implemented sysext-owned MITM CA encrypted with Secure Enclave persistence
• Added XPC generate/commit routes to rotate and atomically swap CA

⚡ Enhancements

• Introduced graceful legacy CA passthrough and commands to retire it

🔧 Refactors

• Reworked in-memory CA state and swapped to rama::bytes::Bytes usage

^{More info}