[refactor](maestro): retire the PKI and federation identity layer

Contract rev 9 removes the instance CA, client certificates, the peer listener and the trust store fleet-wide. Internal traffic is plaintext HTTP on each service single :8080 listener, so there is no peer identity left to authorize: delete lib/pki, lib/federation, devboot, the per-service database role model and the /api/peers* and /api/instances surfaces, and drop the console Trusted services UI. Config delivery now rides a dedicated ES256 token from lib/configsign rather than mTLS, and the instance fingerprint is derived from a persisted random key and is informational only. main.go also wires the surfaces introduced by the later commits, which this change is what makes possible.

src/lib/instance/instance_test.go

@@ -77,12 +77,12 @@ func TestDefaultIdentityFallbacks(t *testing.T) {
 
 func TestLooksLikeContainerID(t *testing.T) {
 	cases := map[string]bool{
-		"6079761d6e4d":                        true,
-		"ABCDEF0123456789abcdef0123456789":    true,
-		"archlinux":                           false,
-		"maestro-1":                           false,
-		"abc":                                 false,
-		"":                                    false,
+		"6079761d6e4d":                     true,
+		"ABCDEF0123456789abcdef0123456789": true,
+		"archlinux":                        false,
+		"maestro-1":                        false,
+		"abc":                              false,
+		"":                                 false,
 	}
 	for s, want := range cases {
 		if got := looksLikeContainerID(s); got != want {