fix(bdd): use exported profile trust for PKI

[sbaum1994]

TL;DR

Follow up on #1075 by removing its BDD-only OpenBao trust rewrite. The PKI feature now validates and consumes the canonical trust data exported in the control-plane profile.

Additional Details

Why

#1075 added a helper that port-forwarded OpenBao and rewrote the compute environment after control-plane installation. The profile-driven registration fix in #1262 makes that second trust path unnecessary and risks letting the PKI test diverge from the operator workflow.

What changed

• Assert that the exported profile contains management and transport bundle trust.
• Initialize the selected CLI config before registration and pass it through register-cluster.
• Assert the installed NVCA values keep insecure QUIC disabled and contain bundle trust with a fingerprint.
• Remove the PKI-only trust rewrite script and its tests.
• Update the feature wiring test to model the exported profile contract.

Customer Release Notes

Not customer visible. This change simplifies PKI BDD coverage.

Plan Summary

Not applicable.

Usage

Not applicable.

Testing

• go test -short ./... in tests/bdd: passed.
• golangci-lint run --config .golangci.yml --new-from-rev origin/test/bdd/pki-single-cluster ./...: passed with 0 new issues.
• golangci-lint run --config .golangci.yml ./... reports two ST1005 findings in dsl/manifests.go that are present in the test(bdd): single-cluster PKI feature with a secured LLM invoke #1075 base and untouched by this PR.
• The PKI live feature was not rerun in this pass. Per the requested scope, local live validation was limited to the single-cluster and multi-cluster Helmfile features on fix(self-managed): restore Helmfile profile registration #1262.

Notes

This PR is based on #1075 and depends on #1262 for the shared profile-registration and secure compute-fixture contract. It should be rebased after those prerequisite changes land.

References

• Helmfile live BDDs fail because register-cluster requires an unexported profile #1254

Related Pull Requests

• test(bdd): single-cluster PKI feature with a secured LLM invoke #1075
• fix(self-managed): restore Helmfile profile registration #1262

Dependencies

No third-party dependency, license, or NOTICE changes. Merge dependency: #1262.

For the Reviewer

Review the removal of the parallel trust path and the assertions that prove the installed values came from the exported profile.

For QA

Run TestSingleClusterHelmfileLLMPKI after #1262 is available on this branch.

Issues

Relates to #1254

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5f7fb7dd-b614-4619-a40d-4e7f88ef8eee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}