Implement privileged first-party issuance path (core + core-bundled apps)

[DeepDiver1975]

Summary

The self-service issuer bot cannot issue leaves for core and the 12 core-bundled apps, because they have no standalone repo with a root appinfo/info.xml to run the nonce challenge against. These are first-party identities that need the privileged first-party issuance path described in the PKI design §15 ("Model A") / §19 Phase 5 — which is not implemented.

The 13 identities

core + comments, dav, federatedfilesharing, federation, files, files_external, files_sharing, files_trashbin, files_versions, provisioning_api, systemtags, updatenotification — all live inside owncloud/core (apps/<id>/appinfo/info.xml), not standalone owncloud/<id> repos; core has no app id.

Why the issuer bot can't do it

internal/enroll/enroll.go calls GetFile(f.Repo, "appinfo/info.xml") (fixed root path) and proves control via a per-repo nonce commit. Neither works for an app whose info.xml is nested inside owncloud/core, nor for core (no info.xml). Verified: owncloud/files, owncloud/dav, etc. return 404 (no standalone repos).

Ask

Implement a privileged, org-gated issuance path (sibling to privileged-revocation.yml / cmd/privrevoke): a workflow_dispatch-only workflow that takes a CSR (or appId + CSR), skips the nonce/repo challenge (control proven by the org-member dispatch gate per design §11/§15), and issues the leaf reusing internal/certtmpl.Leaf + internal/signer under the real intermediate. Should also seed the reserved ledger/<id>.json entries (design §15 / §19 Phase 5).

Context

Needed to complete G2 signing-cert enrollment for the oc11 (11.0.0-rc1) release. The 44 standalone first-party apps go through the normal issuer bot (currently blocked separately by owncloud/admin#211 — bypass actor not live). Key+CSR material for all 13 is already staged in the signing key store; a handoff note with the exact leaf profile accompanies it there.

[DeepDiver1975]

Scope expanded: +9 private enterprise apps (same privileged path)

While running the self-service batch for the oc11 set, 9 more identities turned out to need this privileged path too — not first-party, but private enterprise repos the codesign-bot App can't read:

admin_audit, files_classifier, files_ldap_home, files_lifecycle, firewall, graphapi, kerberos, metrics, ransomware_protection

Their cert-request issues (#26, #35, #38, #39, #44, #46, #48, #50, #56) came back needs-changes = "Could not find appinfo/info.xml", because the repos are private and the App can't read their appinfo/info.xml. This is design §11 (partner / closed-source), whose control-proof is manual/out-of-band rather than the public-repo nonce challenge.

So the privileged issuance path this issue tracks should cover 22 identities: the 13 first-party (core + bundled) and these 9 private enterprise apps. For the private group the ledger entry should be origin: partner. Key+CSR for all 22 are staged in the signing key store; the handoff note there (PRIVILEGED-ISSUANCE-HANDOFF.md) now lists both groups with the leaf profile.

The other ~35 public apps are proceeding through the normal self-service bot.