docs: record EKS konnectivity cert move

docs/PACKAGE_BOUNDARY_MIGRATION.md

@@ -266,6 +266,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `fecf0b28a` | `cmd/eks-gateway-publish` (implementation) | `spinifex/agents/eks/gatewaypublish` | The control-plane VM's gateway publication relay is EKS in-guest behaviour. `cmd/eks-gateway-publish` keeps flag definitions, `EKS_*` environment defaults, parsing, the `fipsboot` import, the `eks-gateway-publish:` log prefix and exit code 1; the agent exposes only `Config` and `Run(ctx, Config) error` and imports no `flag`, `os.Args`, `os.Stdin` or `os.Exit`. The 11 former `fatal` sites had no defers or cleanup and return errors with identical text. `retryDelay` became a variable for tests and the retry wait honours context cancellation, which the binary's background context never triggers. New focused `Run` tests cover every validation and payload error, a wrapped publish, the 30-attempt budget and cancellation. Old and new binaries gave identical stderr and exit codes for nine command-path cases apart from the binary path in flag usage output. Full preflight apart from the known vulnerability-scan finding passed. |
 | `8929ee47b` | `cmd/eks-gateway-fetch` (implementation) | `spinifex/agents/eks/gatewayfetch` | The control-plane VM's add-on and recovery fetch is EKS in-guest behaviour. `cmd/eks-gateway-fetch` keeps its nine flags in their original order with `EKS_*` environment defaults, parsing, the `fipsboot` import, the `eks-gateway-fetch:` log prefix and exit code 1; the agent exposes only `Config` (with `Out` supplied by the binary) and `Run(ctx, Config) error`. The 8 former `fatal` sites had no defers or cleanup and return errors with identical text; a render failure is still not retried. As with publish, `retryDelay` is a test variable and the retry wait honours a cancellation the binary never triggers. The TSV emitters and their tests moved unchanged; new `Run` tests cover the five startup errors, addons and recovery rendering at their gateway paths, an unretried render failure, the attempt budget and cancellation. Old and new binaries gave byte-identical stdout, stderr and exit codes for 11 cases against a local TLS gateway, including both TSV outputs and flags overriding environment. Full preflight apart from the known vulnerability-scan finding passed. |
 | `d064924e6` | `cmd/eks-webhook-cert` (implementation) | `spinifex/agents/eks/webhookcert` | Minting and caching the in-cluster admission webhook's self-signed serving certificate is EKS in-guest behaviour. `cmd/eks-webhook-cert` keeps the `-dir`, `-cn` and `-dns` flags, parsing, the usage text, the `fipsboot` import, the `eks-webhook-cert:` log prefix and exit code 1; the agent exposes only `Config` (with `Out` supplied by the binary) and `Run(ctx, Config) error` and depends only on the standard library. The 3 former `fatal` sites had no defers or cleanup; a key-write failure still leaves `tls.crt` on disk, and a stdout write error is still ignored. Moving out of `cmd/` brought the file under gosec, whose G306 finding on the public certificate's 0644 mode is annotated with its reason. Existing tests moved unchanged; new `Run` tests cover the required-flag and blank-SAN errors, the cache-directory failure and the one-line CA/leaf/key output. Old and new binaries gave identical stdout, stderr, exit codes, file modes and output shape for 7 cases, and a second run reused the cached pair. Full preflight apart from the known vulnerability-scan finding passed. |
+| `fba330b86` | `cmd/eks-konnectivity-cert` (implementation) | `spinifex/agents/eks/konnectivitycert` | Issuing and caching the on-node konnectivity-server certificate from the K3s cluster CA is EKS in-guest behaviour. `cmd/eks-konnectivity-cert` keeps its five flags and defaults (including `-cn konnectivity-server`), parsing, the usage text, the `fipsboot` import, the `eks-konnectivity-cert:` log prefix and exit code 1; the agent exposes only `Config` (with `Out` supplied by the binary) and `Run(ctx, Config) error` and depends only on the standard library. The 3 former `fatal` sites had no defers or cleanup; a key-write failure still leaves `tls.crt` on disk, and a stdout write error is still ignored. The gosec G306 finding on the public certificate's 0644 mode is annotated with its reason. Existing signing, reuse/reissue and SAN-splitting tests moved unchanged; new `Run` tests cover the required-flag and blank-SAN errors, an unreadable CA and the path output with IP and DNS SANs. Old and new binaries gave identical stdout, stderr, exit codes, file modes, CA verification, SANs and subject for 10 cases including SEC1 and PKCS8 CA keys, and the new binary reused the cached certificate and reissued it on a SAN change. Full preflight apart from the known vulnerability-scan finding passed. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS