docs: record foundation pki extraction

docs/PACKAGE_BOUNDARY_MIGRATION.md

@@ -251,6 +251,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `99278d5ff` | `spinifex/handlers/dns` | `spinifex/domains/dns` | DNS control semantics (zone records, resolver and name policy) are DNS-domain ownership, distinct from OVN and host-network realisation. The package name was already `dns`, so callers dropped the `handlers_dns` alias; the multinode E2E test that also imports `miekg/dns` uses `dnsdomain`. Six path comments were updated. The move exposes imports of `runtime/compute/vm`, `network/reconcile` and `bootstrap/config`, recorded in the dependency-rule debt. The `integration,segscanoracle` build fails identically on `origin/dev` (`predastoreS3Client` is in package `integration` but called from `integration_test`) and was not touched. Full preflight (excluding the pre-existing containerd advisory), focused DNS, ACM, guest-metadata, daemon, northstar, admin and CLI suites, `manifest-check` and tagged integration, E2E and E2E bench compilation passed. |
 | `06b1eefd9` | `spinifex/runtime/roles/northstar` (`BootstrapBaseZone`) | `spinifex/domains/dns` | Seeding the base zone and its NS topology is DNS control-plane work, so it joins the DNS domain and the northstar role is left with process startup and reload only. Its tests moved with it and reuse the DNS package's identical `fakeS3` helper. The daemon flakes seen during verification (`TestRestoreInstances_ClusterRecordWinsForSharedInstance` under load; `TestKVIPSecBarrier_*` and `TestDrainVolumeRecordsItsPointAfterTheWork` under `-count=3`) reproduce identically on `origin/dev`. Full preflight (excluding the pre-existing containerd advisory), focused DNS, northstar and CLI suites and tagged integration/E2E compilation passed. |
 | `8ca318070` | `spinifex/admin` (`SystemAccountID`) | `spinifex/foundation/aws/identifiers` (`GlobalAccountID`) | `SystemAccountID()` duplicated the existing `GlobalAccountID` constant (`000000000000`), so its callers now use the constant and the function and its test are deleted rather than moved. `DefaultAccountID` and `DefaultAccountName` are Mulga bootstrap identity policy, not AWS identifier syntax, and stay in admin for a later IAM/account bootstrap slice. Full preflight (excluding the pre-existing containerd advisory), focused admin, account-teardown, EKS, CLI and identifier suites and tagged integration/E2E compilation passed. |
+| `930040875` | `spinifex/admin` (`LoadCAKeyPair`) | `spinifex/foundation/pki` | Loading a PEM certificate and PKCS8 RSA key is a generic primitive; the new package imports no Spinifex package and holds no certificate identity or file layout. `GenerateCACert` and `GenerateSignedCert` stay in admin because they embed Spinifex certificate identity and validity policy. Full preflight (excluding the pre-existing containerd advisory), focused admin and RDS suites and tagged integration/E2E compilation passed. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS
@@ -318,6 +319,7 @@ Each needs a consumer-owned capability, projection or versioned contract before
 These residuals were recorded by individual slices and must be resolved once the structural moves are complete, before the dependency lint is enabled.
 
 - Guest metadata: the cross-domain and runtime imports above.
+- `admin` → `operator/admin` is blocked until its shared pieces have owners: `DefaultAccountID`/`DefaultAccountName` (IAM/account bootstrap), `GenerateAWSAccessKey`/`GenerateAWSSecretKey` (IAM credentials), `PromoteSystemImage` (EC2 image domain), and `GenerateCACert`/`GenerateSignedCert` (Spinifex certificate issuance, used by the NATS role and RDS).
 - `domains/dns`: imports `runtime/compute/vm` (domain-to-runtime), `network/reconcile` for the reconcile lock and `bootstrap/config` for node configuration.
 - ACM: the IAM AES-GCM helper import and gateway-owned action dispatch (ACM relocation residuals).
 - `runtime/roles/awsgw`: the quota reconcile loop belongs to `domains/admission/quota`, and the EKS token-verify responder belongs with STS or EKS identity.