Certificate rotation — short-lived certs (1h TTL) with automated renewal via SPIRE

[shreyanshjain7174]

SPIRE Agent rotates SVIDs automatically. Test rotation under load.

Acceptance:

• SPIRE Agent runs as DaemonSet
• Rotation tested with mTLS connections active
• No connection drops during rotation
• Metrics: certs issued, rotations, failures

[shreyanshjain7174]

Cross-link: implicit dependency of RFC-0001 epic #146

Per the roadmap reconciliation on #146:

This issue is an implicit dependency of the SPIFFE/SPIRE design in RFC-0001. SPIRE issues short-lived SVIDs by default (configurable TTL; recommended 1h for SVIDs, 24h for trust bundles) and handles renewal via the Workload API — exactly what's specified in story #148.

Keeping this issue open as the canonical "rotation" ask. The implementation arrives as part of the SPIRE bundling story #153 once the validation gate in #155 clears.