test(config): Sprint 4 ARCH-003 fixture alignment for ACK-required tests

Sprint 5 CI follow-up. Pre-fix: the Sprint 5 push tripped three Go
test failures in internal/config:

  --- FAIL: TestLoad_AllEnvVarsSet (0.00s)
      config_test.go:261: Load() returned error: CERTCTL_KEYGEN_MODE=server
      is demo-only — ... Set CERTCTL_DEMO_MODE_ACK=true ...
  --- FAIL: TestValidate_AcceptsServerKeygenWithDemoAck (0.00s)
      config_test.go:2082: Validate(KeygenMode=server, DemoAck=true,
      fresh TS) = job timeout interval must be at least 1 second; want nil
  --- FAIL: TestValidate_AgentKeygenIgnoresDemoAck (0.00s)
      config_test.go:2106: Validate(KeygenMode=agent, DemoAck=false) =
      job timeout interval must be at least 1 second; want nil (production
      default must boot)

All three are fallout from cross-sprint interactions:

1. TestLoad_AllEnvVarsSet is the comprehensive 'every CERTCTL_* env
   var' exerciser. It sets KEYGEN_MODE=server because the per-field
   assertion at line 292 pins cfg.Keygen.Mode == 'server'. Sprint 4
   ARCH-003 (commit 7e98b0e) made Load()→Validate() refuse to boot
   in server-keygen mode without the demo-ack pair, so this test
   needed the ACK env vars added alongside the existing KEYGEN_MODE
   set. Fix: add CERTCTL_DEMO_MODE_ACK=true + CERTCTL_DEMO_MODE_ACK_TS
   set to time.Now().Unix() (well within the SEC-H3 24h freshness
   window) right after the KEYGEN_MODE line, with an inline comment
   explaining why the SEC-H3 demo-ack pair is needed here.

2. TestValidate_AcceptsServerKeygenWithDemoAck and
   TestValidate_AgentKeygenIgnoresDemoAck are NEW in Sprint 4. They
   construct Config directly and call Validate(), but their
   Scheduler fixtures omit three load-bearing fields:
     - JobTimeoutInterval (>= 1s required, config.go:1286)
     - AwaitingCSRTimeout (>= 1s required, config.go:1290)
     - AwaitingApprovalTimeout (>= 1s required, config.go:1294)
   These three were added in earlier milestones (I-003 timeout
   sweeper). The Sprint 4 fixtures pre-date the alignment that
   landed elsewhere in the file (see line 1543's full template). Fix:
   add the three fields with the same production-shaped values used
   in the rest of the test file (10m / 24h / 168h).

Verified locally with the canonical-runner Go 1.25.10 toolchain:

  go test -count=1 \
    -run 'TestLoad_AllEnvVarsSet|TestValidate_AcceptsServerKeygenWithDemoAck|TestValidate_AgentKeygenIgnoresDemoAck' \
    ./internal/config/
  # ok  github.com/certctl-io/certctl/internal/config  0.005s

  go test -count=1 ./internal/config/
  # ok  github.com/certctl-io/certctl/internal/config  0.804s

  gofmt -l internal/config/config_test.go
  # (empty — clean)

  go vet ./internal/config/...
  # (empty — clean)

Closes the internal/config leg of the Sprint 5 CI redness. Together
with the M-009 carve-out commit, this returns the Sprint 5 push to
green.

internal/config/config_test.go

@@ -232,6 +232,14 @@ func TestLoad_AllEnvVarsSet(t *testing.T) {
 	t.Setenv("CERTCTL_RATE_LIMIT_BURST", "200")
 	t.Setenv("CERTCTL_CORS_ORIGINS", "https://a.com,https://b.com")
 	t.Setenv("CERTCTL_KEYGEN_MODE", "server")
+	// Sprint 4 ARCH-003 made Load()→Validate() refuse to boot in
+	// server-keygen mode without an explicit demo-mode acknowledgement.
+	// This test exercises the "every CERTCTL_* env var set" path, so
+	// it sets KEYGEN_MODE=server — which now requires the demo-ack
+	// pair. Mirror the SEC-H3 demo-ack pattern: ACK=true + fresh TS
+	// within the 24h window.
+	t.Setenv("CERTCTL_DEMO_MODE_ACK", "true")
+	t.Setenv("CERTCTL_DEMO_MODE_ACK_TS", strconv.FormatInt(time.Now().Unix(), 10))
 	t.Setenv("CERTCTL_LOG_LEVEL", "debug")
 	t.Setenv("CERTCTL_LOG_FORMAT", "text")
 	t.Setenv("CERTCTL_DATABASE_URL", "postgres://user:pass@db:5432/certctl")
@@ -2076,6 +2084,9 @@ func TestValidate_AcceptsServerKeygenWithDemoAck(t *testing.T) {
 			NotificationProcessInterval: 1 * time.Minute,
 			NotificationRetryInterval:   2 * time.Minute,
 			RetryInterval:               5 * time.Minute,
+			JobTimeoutInterval:          10 * time.Minute,
+			AwaitingCSRTimeout:          24 * time.Hour,
+			AwaitingApprovalTimeout:     168 * time.Hour,
 		},
 	}
 	if err := cfg.Validate(); err != nil {
@@ -2100,6 +2111,9 @@ func TestValidate_AgentKeygenIgnoresDemoAck(t *testing.T) {
 			NotificationProcessInterval: 1 * time.Minute,
 			NotificationRetryInterval:   2 * time.Minute,
 			RetryInterval:               5 * time.Minute,
+			JobTimeoutInterval:          10 * time.Minute,
+			AwaitingCSRTimeout:          24 * time.Hour,
+			AwaitingApprovalTimeout:     168 * time.Hour,
 		},
 	}
 	if err := cfg.Validate(); err != nil {