M2 §2: run actions and manifest fetch over mTLS with Maestro's identity

Extract maestroTransport() (Maestro's identity cert + instance CA) and
expose PeerTransport()/Scheme()/InsecureInternal() so every service peer
edge uses the same client. RunAction now targets
https://{ip}:{port}/action/{name} presenting Maestro's cert (services
require a CA-issued client cert, so only Maestro can drive actions — T4)
and FetchManifestWithRetry fetches /_manifest the same way.
INSECURE_INTERNAL=1 keeps the dev fleet plaintext (debug compose updated
to set it).

docker-compose.debug.yaml

@@ -14,6 +14,7 @@ services:
     environment:
       - DEV_MODE=true
       - DCNTRLIZED_DEV=true
+      - INSECURE_INTERNAL=1
       - GITEA_URL=${GITEA_URL:-http://192.168.122.183:3000}
       - GITEA_REGISTRY_RO_TOKEN=${GITEA_REGISTRY_RO_TOKEN}
       - GITEA_RW_PACKAGE_TOKEN=${GITEA_RW_PACKAGE_TOKEN}