Implement M8: agent-side key generation with ECDSA P-256

Private keys never leave agent infrastructure. Agents generate ECDSA P-256
key pairs locally, store them with 0600 permissions, and submit only the CSR
(public key) to the control plane. New AwaitingCSR job state pauses
renewal/issuance jobs until the agent submits its CSR. Server-side keygen
retained behind CERTCTL_KEYGEN_MODE=server for demo/development.

Key changes:
- Dual keygen mode via CERTCTL_KEYGEN_MODE (agent default, server for demo)
- AwaitingCSR job state with CommonName/SANs in work response
- Agent ECDSA P-256 keygen, local key storage, CSR-only submission
- CompleteAgentCSRRenewal server-side flow for agent-submitted CSRs
- DeploymentRequest.KeyPEM for agent-provided keys during deployment
- Dockerfile.agent creates /var/lib/certctl/keys with correct ownership

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/domain/job.go

@@ -35,11 +35,12 @@ const (
 type JobStatus string
 
 const (
-	JobStatusPending   JobStatus = "Pending"
-	JobStatusRunning   JobStatus = "Running"
-	JobStatusCompleted JobStatus = "Completed"
-	JobStatusFailed    JobStatus = "Failed"
-	JobStatusCancelled JobStatus = "Cancelled"
+	JobStatusPending     JobStatus = "Pending"
+	JobStatusAwaitingCSR JobStatus = "AwaitingCSR"
+	JobStatusRunning     JobStatus = "Running"
+	JobStatusCompleted   JobStatus = "Completed"
+	JobStatusFailed      JobStatus = "Failed"
+	JobStatusCancelled   JobStatus = "Cancelled"
 )
 
 // DeploymentJob represents a job that deploys a certificate to a target via an agent.
@@ -55,6 +56,8 @@ type WorkItem struct {
 	ID            string          `json:"id"`
 	Type          JobType         `json:"type"`
 	CertificateID string          `json:"certificate_id"`
+	CommonName    string          `json:"common_name,omitempty"`
+	SANs          []string        `json:"sans,omitempty"`
 	TargetID      *string         `json:"target_id,omitempty"`
 	TargetType    string          `json:"target_type,omitempty"`
 	TargetConfig  json.RawMessage `json:"target_config,omitempty"`