ACME agent enrollment — extend ACME protocol for automated agent certificate provisioning

[shreyanshjain7174]

Adapt RFC 8555 ACME for agent identity. Operator handles enrollment automatically.

Acceptance:

• ACME-Agent server (separate binary)
• DNS-01 challenge support
• Proof-of-pod via SPIFFE attestor
• X.509 SVID format certificates
• Reference implementation documented

[shreyanshjain7174]

Cross-link: now a properly considered alternative in RFC-0001 epic #146

Per the roadmap reconciliation on #146:

Adding ACME-based agent enrollment as a properly considered alternative in RFC-0001 §8 "Alternatives considered" (was missing — overlooked during RFC authoring). The follow-up PR will compare:

• SPIFFE/SPIRE (RFC-0001 default) — workload-scoped identity, federation primitives, CNCF graduated
• ACME (this issue) — standards-based, broader tooling ecosystem, but no native workload identity model

Keeping this issue open as the canonical "ACME path" ask. If the community prefers ACME over SPIFFE for specific deployment scenarios (e.g., heavy cert-manager users who don't want SPIRE), this gives us the design hook.