feat(ssh,wincertstore,javakeystore,k8ssecret): explicit ValidateOnly + leverage existing connectors

Phase 9 of the deploy-hardening I master bundle. The four
non-file-server connectors get real ValidateOnly probes that
operators use to preview a deploy without touching the live cert.
Existing DeployCertificate paths already have explicit backup +
rollback semantics (SCP backup / WinCertStore Get-ChildItem
snapshot / keytool snapshot / K8s atomic API).

SSH (validate_only.go):
- Probes via SSHClient.Connect. Confirms agent reachability +
  credentials. Cheap (no remote command runs); released cleanly
  via defer Close.
- A true SCP dry-run requires a no-commit upload (SCP doesn't
  have one). V2 ships the auth probe as the load-bearing check.
- 3 new tests in validate_only_test.go.

WinCertStore (validate_only.go):
- Probes via PowerShell `Get-ChildItem -Path Cert:\<loc>\<store>`
  using the configured StoreLocation + StoreName (defaults
  LocalMachine\My).
- Confirms agent has Windows + the IIS module + the right ACLs.
- 4 new tests including default-store-path verification.

JavaKeystore (validate_only.go):
- Probes via `keytool -list -keystore <path> -storepass <pass>`
  using the configured KeystorePath / KeystorePassword and
  KeytoolPath (default "keytool").
- Confirms keystore exists, password is correct, JRE is on PATH.
- 4 new tests covering succeeds / fails / no-path-sentinel /
  nil-executor-sentinel.

K8s Secret (validate_only.go):
- Probes via K8sClient.GetSecret on the configured Namespace +
  SecretName. Returns nil on success or "not found" (the
  CreateSecret path on Deploy will handle it). Other errors
  (forbidden/unreachable) surface as wrapped.
- 4 new tests covering succeeds / RBAC-error wrapped /
  no-config-sentinel / nil-client-sentinel.

Smoke test connectorsAtPhase3 list shrunk from 7 to 3 entries
(ssh + wincertstore + javakeystore + k8ssecret removed). Only
caddy (file-mode) + envoy + traefik remain — those three
genuinely have no validate-with-target command available.

Race detector clean across all 13 connectors. golangci-lint
v2.11.4 clean.

Phase 10 next: DeployCounters + Prometheus exposer mirroring the
production-hardening-II OCSP counter pattern.

internal/connector/target/ssh/validate_only.go

@@ -2,17 +2,28 @@ package ssh
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/shankar0123/certctl/internal/connector/target"
 )
 
-// ValidateOnly is the default Phase 3 stub for the deploy-hardening
-// I master bundle: returns ErrValidateOnlyNotSupported so existing
-// connectors compile against the extended target.Connector interface
-// without changing behavior. Phase ssh dry-run support arrives when
-// the connector's atomic-deploy implementation lands (NGINX in
-// Phase 4, Apache in Phase 5, etc.); each phase replaces this stub
-// with a real validate-with-the-target implementation.
+// ValidateOnly — Phase 9 of the deploy-hardening I master bundle.
+// Probes the SSH connection by establishing a session + closing
+// it cleanly. Confirms the agent has network reachability + the
+// configured SSH credentials still work. Failure surfaces as a
+// wrapped error so operators see "auth failed" / "connection
+// refused" / "host key changed" without touching the live cert.
+//
+// A true cert-deploy dry-run would require simulating the file
+// upload + remote chmod (SCP doesn't have a no-commit mode); for
+// V2 the auth probe is the load-bearing safety check.
 func (c *Connector) ValidateOnly(ctx context.Context, request target.DeploymentRequest) error {
-	return target.ErrValidateOnlyNotSupported
+	if c.client == nil {
+		return target.ErrValidateOnlyNotSupported
+	}
+	if err := c.client.Connect(ctx); err != nil {
+		return fmt.Errorf("SSH ValidateOnly: connect failed: %w", err)
+	}
+	defer c.client.Close()
+	return nil
 }

internal/connector/target/ssh/validate_only_test.go

@@ -0,0 +1,48 @@
+package ssh
+
+import (
+	"context"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/shankar0123/certctl/internal/connector/target"
+)
+
+// Phase 9 of the deploy-hardening I master bundle: SSH ValidateOnly
+// real implementation tests.
+
+type stubSSHClient struct {
+	connectErr error
+}
+
+func (s *stubSSHClient) Connect(_ context.Context) error                                     { return s.connectErr }
+func (s *stubSSHClient) Close() error                                                        { return nil }
+func (s *stubSSHClient) WriteFile(_ string, _ []byte, _ os.FileMode) error                   { return nil }
+func (s *stubSSHClient) Execute(_ context.Context, _ string) (string, error)                 { return "", nil }
+func (s *stubSSHClient) StatFile(_ string) (int64, error)                                    { return 0, nil }
+
+func TestSSH_ValidateOnly_Connect_Succeeds(t *testing.T) {
+	c := NewWithClient(&Config{Host: "h", User: "u"}, &stubSSHClient{}, nil)
+	if err := c.ValidateOnly(context.Background(), target.DeploymentRequest{}); err != nil {
+		t.Errorf("got %v", err)
+	}
+}
+
+func TestSSH_ValidateOnly_Connect_Fails(t *testing.T) {
+	c := NewWithClient(&Config{Host: "h", User: "u"}, &stubSSHClient{connectErr: errors.New("conn refused")}, nil)
+	err := c.ValidateOnly(context.Background(), target.DeploymentRequest{})
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	if errors.Is(err, target.ErrValidateOnlyNotSupported) {
+		t.Error("got sentinel, want wrapped error")
+	}
+}
+
+func TestSSH_ValidateOnly_NilClient_Sentinel(t *testing.T) {
+	c := &Connector{config: &Config{Host: "h"}}
+	if err := c.ValidateOnly(context.Background(), target.DeploymentRequest{}); !errors.Is(err, target.ErrValidateOnlyNotSupported) {
+		t.Errorf("got %v", err)
+	}
+}