M2 §2: run actions and manifest fetch over mTLS with Maestro's identity

Extract maestroTransport() (Maestro's identity cert + instance CA) and
expose PeerTransport()/Scheme()/InsecureInternal() so every service peer
edge uses the same client. RunAction now targets
https://{ip}:{port}/action/{name} presenting Maestro's cert (services
require a CA-issued client cert, so only Maestro can drive actions — T4)
and FetchManifestWithRetry fetches /_manifest the same way.
INSECURE_INTERNAL=1 keeps the dev fleet plaintext (debug compose updated
to set it).

src/lib/docker/client.go

@@ -25,6 +25,7 @@ import (
 	"strings"
 	"time"
 
+	"git.dcntrlized.org/Dcntrlized/Maestro/lib/authmgmt"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/logger"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/types"
 
@@ -92,12 +93,18 @@ func ListContainers(dc *DockerClient) ([]string, error) {
 // fetchManifestWithRetry polls the container's manifest endpoint until it succeeds or max retries are reached.
 // Could probably be simplified to (ctx, container) with maxRetries and retryDelay hardcoded, low priority TODO
 func FetchManifestWithRetry(ctx context.Context, host, port string, maxRetries int, retryDelay time.Duration) (*types.Manifest, error) {
-	url := fmt.Sprintf("http://%s:%s/_manifest", host, port)
+	// The service peer edge is mutual TLS (M2 §2), same as RunAction: Maestro's
+	// identity cert, https scheme, with the plaintext dev escape hatch.
+	url := fmt.Sprintf("%s://%s:%s/_manifest", authmgmt.Scheme(), host, port)
 	var resp *http.Response
 	var err error
 
 	// Create a client that respects context deadlines/cancellation
-	client := &http.Client{Timeout: 2 * time.Second}
+	transport, terr := authmgmt.PeerTransport()
+	if terr != nil {
+		return nil, fmt.Errorf("build peer transport: %w", terr)
+	}
+	client := &http.Client{Timeout: 2 * time.Second, Transport: transport}
 
 	for range maxRetries {
 		req, reqErr := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)