* add versioned root and intermediate CA profile documents
* extend the strict profile schema with closed certificate kinds
* package canonical built-in root and intermediate profiles
* enforce immutable import and explicit activation for CA profiles
* bind CA credentials to exact profile ID, version, and canonical hash
* resolve active profiles for root and intermediate issuance
* validate issuer-controlled CA requests before backend execution
* enforce complete CA DER and extension postconditions
* reject inactive, mismatched, and malicious profile/backend inputs
* preserve historical credential bindings across profile activation changes
* add root and intermediate profile version-switch coverage
BREAKING CHANGE: root and intermediate CA issuance now requires an explicitly imported and activated versioned CA profile.
* add strict versioned JSON profile documents and canonical serialization
* package validated built-in end-entity profile templates
* persist immutable profile versions with canonical hashes
* require explicit atomic profile activation
* resolve issuance profiles only from validated active store references
* enforce deny-by-default subject and SAN policies
* support typed DNS, IP, URI, and RFC822 SAN identities
* remove requester control over certificate serials and reserved fields
* bind issued credentials to exact profile ID, version, and hash
* enforce closed end-entity and CA credential profile-binding variants
* validate issued DER against the complete approved profile
* add real SAN issuance, CSR rejection, malicious-backend, lifecycle, snapshot, and redaction coverage
BREAKING CHANGE: replaces direct and mutable pre-release profile handling with strict JSON import,
immutable version persistence, explicit activation, and exact credential profile bindings.
fix: harden FsCodec determinism and persisted type round-trips
fix: align CSR PoP verification with standards-compatible signature validation
fix: make async approval deny propagation deterministic in signing bus tests
chore: reduce IDE/Gradle drift by strengthening regression coverage
