fix(agent): make native cert auto-renew actually work end-to-end

Two real-deploy renew bugs (found running the live /renew):
- the /renew mTLS request pinned the enroll caChain as the server CA → TLS
  'unable to get local issuer certificate' (the LE-fronted CP is publicly
  trusted). Verify the server against SYSTEM roots (drop ca), keep the client
  cert + rejectUnauthorized:true. (TlsClientOptions.ca now optional.)
- renewCert parsed {cert, caChain:string}, but the CP returns cert=base64(DER)
  + caChain=base64(DER)[]; normalize to PEM (shared certs/pem.ts, reused by
  native enroll). Verified live: cert rotated 13:41→next-day, frpc restarted,
  tunnel stayed up. 281 tests pass.

agent/test/nativeRenew.test.ts

@@ -69,7 +69,9 @@ describe('createMtlsFetch (A5)', () => {
     expect(await res.json()).toEqual({ cert: 'NEW', caChain: 'NEWCA' })
     expect(seen[0]!.url).toBe('https://cp.example.com/renew')
     expect(seen[0]!.tls.cert).toBe('LEAFCERT')
-    expect(seen[0]!.tls.ca).toBe('CACHAIN')
+    // /renew verifies the LE-fronted control-plane against the SYSTEM roots, so no private CA is pinned
+    // (pinning the enroll caChain here fails with "unable to get local issuer certificate").
+    expect(seen[0]!.tls.ca).toBeUndefined()
     expect(seen[0]!.tls.rejectUnauthorized).toBe(true)
     expect(String(seen[0]!.tls.key)).toContain('PRIVATE KEY') // in-process PKCS#8 key, mTLS only
     expect(seen[0]!.init.method).toBe('POST')
@@ -166,7 +168,7 @@ describe('startNativeAutoRenew (A5 end-to-end)', () => {
     const timer = new FakeTimer()
     const request: MtlsRequest = async () => ({
       status: 200,
-      body: JSON.stringify({ cert: 'FRESHLEAF', caChain: 'CACHAIN' }),
+      body: JSON.stringify({ cert: 'FRESHLEAF', caChain: ['CACHAIN'] }),
     })
     const restartChild = vi.fn()
     const stop = vi.fn()
@@ -183,7 +185,7 @@ describe('startNativeAutoRenew (A5 end-to-end)', () => {
     timer.advance(1000) // renewal fires at ~2/3 TTL
     await flush()
 
-    expect(ks.loadCert()!.certPem).toBe('FRESHLEAF') // atomic persist
+    expect(ks.loadCert()!.certPem).toContain('FRESHLEAF') // atomic persist
     expect(restartChild).toHaveBeenCalledTimes(1) // frpc restarted onto the fresh leaf
     expect(stop).not.toHaveBeenCalled()
     controller.stop()
@@ -222,7 +224,7 @@ describe('startNativeAutoRenew (A5 end-to-end)', () => {
     const request: MtlsRequest = async () => {
       calls += 1
       if (calls === 1) throw new Error('ECONNREFUSED')
-      return { status: 200, body: JSON.stringify({ cert: 'FRESHLEAF', caChain: 'CACHAIN' }) }
+      return { status: 200, body: JSON.stringify({ cert: 'FRESHLEAF', caChain: ['CACHAIN'] }) }
     }
     const restartChild = vi.fn()
     const stop = vi.fn()
@@ -252,7 +254,7 @@ describe('startNativeAutoRenew (A5 end-to-end)', () => {
 
     timer.advance(500) // backoff retry fires and succeeds
     await flush()
-    expect(ks.loadCert()!.certPem).toBe('FRESHLEAF')
+    expect(ks.loadCert()!.certPem).toContain('FRESHLEAF')
     expect(restartChild).toHaveBeenCalledTimes(1)
     expect(lines.join('\n')).not.toContain('LEAFCERT')
     controller.stop()