feat(ssh,wincertstore,javakeystore,k8ssecret): explicit ValidateOnly + leverage existing connectors

Phase 9 of the deploy-hardening I master bundle. The four
non-file-server connectors get real ValidateOnly probes that
operators use to preview a deploy without touching the live cert.
Existing DeployCertificate paths already have explicit backup +
rollback semantics (SCP backup / WinCertStore Get-ChildItem
snapshot / keytool snapshot / K8s atomic API).

SSH (validate_only.go):
- Probes via SSHClient.Connect. Confirms agent reachability +
  credentials. Cheap (no remote command runs); released cleanly
  via defer Close.
- A true SCP dry-run requires a no-commit upload (SCP doesn't
  have one). V2 ships the auth probe as the load-bearing check.
- 3 new tests in validate_only_test.go.

WinCertStore (validate_only.go):
- Probes via PowerShell `Get-ChildItem -Path Cert:\<loc>\<store>`
  using the configured StoreLocation + StoreName (defaults
  LocalMachine\My).
- Confirms agent has Windows + the IIS module + the right ACLs.
- 4 new tests including default-store-path verification.

JavaKeystore (validate_only.go):
- Probes via `keytool -list -keystore <path> -storepass <pass>`
  using the configured KeystorePath / KeystorePassword and
  KeytoolPath (default "keytool").
- Confirms keystore exists, password is correct, JRE is on PATH.
- 4 new tests covering succeeds / fails / no-path-sentinel /
  nil-executor-sentinel.

K8s Secret (validate_only.go):
- Probes via K8sClient.GetSecret on the configured Namespace +
  SecretName. Returns nil on success or "not found" (the
  CreateSecret path on Deploy will handle it). Other errors
  (forbidden/unreachable) surface as wrapped.
- 4 new tests covering succeeds / RBAC-error wrapped /
  no-config-sentinel / nil-client-sentinel.

Smoke test connectorsAtPhase3 list shrunk from 7 to 3 entries
(ssh + wincertstore + javakeystore + k8ssecret removed). Only
caddy (file-mode) + envoy + traefik remain — those three
genuinely have no validate-with-target command available.

Race detector clean across all 13 connectors. golangci-lint
v2.11.4 clean.

Phase 10 next: DeployCounters + Prometheus exposer mirroring the
production-hardening-II OCSP counter pattern.

internal/connector/target/javakeystore/validate_only.go

@@ -2,17 +2,35 @@ package javakeystore
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/shankar0123/certctl/internal/connector/target"
 )
 
-// ValidateOnly is the default Phase 3 stub for the deploy-hardening
-// I master bundle: returns ErrValidateOnlyNotSupported so existing
-// connectors compile against the extended target.Connector interface
-// without changing behavior. Phase javakeystore dry-run support arrives when
-// the connector's atomic-deploy implementation lands (NGINX in
-// Phase 4, Apache in Phase 5, etc.); each phase replaces this stub
-// with a real validate-with-the-target implementation.
+// ValidateOnly — Phase 9. Probes via `keytool -list -keystore
+// <path> -storepass <pass>`. Confirms the keystore exists, the
+// password is correct, and `keytool` is on PATH. Failure mode
+// surfaces the actual keytool stderr (wrong password, missing
+// JRE, file not found, etc.).
 func (c *Connector) ValidateOnly(ctx context.Context, request target.DeploymentRequest) error {
-	return target.ErrValidateOnlyNotSupported
+	if c.executor == nil || c.config == nil {
+		return target.ErrValidateOnlyNotSupported
+	}
+	if c.config.KeystorePath == "" {
+		return target.ErrValidateOnlyNotSupported
+	}
+	args := []string{"-list", "-keystore", c.config.KeystorePath}
+	if c.config.KeystorePassword != "" {
+		args = append(args, "-storepass", c.config.KeystorePassword)
+	}
+	keytool := c.config.KeytoolPath
+	if keytool == "" {
+		keytool = "keytool"
+	}
+	out, err := c.executor.Execute(ctx, keytool, args...)
+	if err != nil {
+		return fmt.Errorf("JavaKeystore ValidateOnly: keytool -list failed: %w (output: %s)", err, out)
+	}
+	_ = out
+	return nil
 }

internal/connector/target/javakeystore/validate_only_test.go

@@ -0,0 +1,48 @@
+package javakeystore
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/shankar0123/certctl/internal/connector/target"
+)
+
+type stubExec struct {
+	out string
+	err error
+}
+
+func (s *stubExec) Execute(_ context.Context, _ string, _ ...string) (string, error) {
+	return s.out, s.err
+}
+
+func TestJavaKeystore_ValidateOnly_Succeeds(t *testing.T) {
+	c := NewWithExecutor(&Config{KeystorePath: "/etc/jks/cacerts", KeystorePassword: "changeit"}, nil, &stubExec{out: "Keystore type: jks"})
+	if err := c.ValidateOnly(context.Background(), target.DeploymentRequest{}); err != nil {
+		t.Errorf("got %v", err)
+	}
+}
+
+func TestJavaKeystore_ValidateOnly_Fails(t *testing.T) {
+	c := NewWithExecutor(&Config{KeystorePath: "/missing"}, nil, &stubExec{out: "keystore tampered with", err: errors.New("exit 1")})
+	err := c.ValidateOnly(context.Background(), target.DeploymentRequest{})
+	if err == nil || !strings.Contains(err.Error(), "tampered") {
+		t.Errorf("got %v", err)
+	}
+}
+
+func TestJavaKeystore_ValidateOnly_NoPath_Sentinel(t *testing.T) {
+	c := NewWithExecutor(&Config{}, nil, &stubExec{})
+	if err := c.ValidateOnly(context.Background(), target.DeploymentRequest{}); !errors.Is(err, target.ErrValidateOnlyNotSupported) {
+		t.Errorf("got %v", err)
+	}
+}
+
+func TestJavaKeystore_ValidateOnly_NilExec_Sentinel(t *testing.T) {
+	c := &Connector{config: &Config{KeystorePath: "/some/jks"}}
+	if err := c.ValidateOnly(context.Background(), target.DeploymentRequest{}); !errors.Is(err, target.ErrValidateOnlyNotSupported) {
+		t.Errorf("got %v", err)
+	}
+}