fix(agent): make native cert auto-renew actually work end-to-end

Two real-deploy renew bugs (found running the live /renew):
- the /renew mTLS request pinned the enroll caChain as the server CA → TLS
  'unable to get local issuer certificate' (the LE-fronted CP is publicly
  trusted). Verify the server against SYSTEM roots (drop ca), keep the client
  cert + rejectUnauthorized:true. (TlsClientOptions.ca now optional.)
- renewCert parsed {cert, caChain:string}, but the CP returns cert=base64(DER)
  + caChain=base64(DER)[]; normalize to PEM (shared certs/pem.ts, reused by
  native enroll). Verified live: cert rotated 13:41→next-day, frpc restarted,
  tunnel stayed up. 281 tests pass.

agent/test/nativeRenewTransport.test.ts

@@ -115,7 +115,8 @@ describe('defaultMtlsRequest transport (A5 — real node:https)', () => {
     expect(seenOpts.rejectUnauthorized).toBe(true) // anti-MITM (INV14)
     expect(seenOpts.method).toBe('POST')
     expect(seenOpts.cert).toBe('LEAFCERT')
-    expect(seenOpts.ca).toBe('CACHAIN')
+    // ca omitted ⇒ verify the LE-fronted control-plane against the system roots (not the private CA).
+    expect(seenOpts.ca).toBeUndefined()
     expect(String(seenOpts.key)).toContain('PRIVATE KEY') // in-process PKCS#8 key
     // HIGH fix: a socket timeout is armed with the sane default so a stall can never hang forever.
     expect(seenReq!.setTimeoutCalls).toHaveLength(1)