fix(client): report stale issued configurations

[ahcrm-core]

Summary

Add an operator-visible freshness report for static client configurations described in #46.

• record only the material settings embedded in each successfully generated protocol;
• report every currently issued client as CURRENT, STALE with exact fields, or UNKNOWN when it predates tracking;
• preserve the other protocol's record during a partial reissue;
• store no credentials, write the registry atomically with mode 0600;
• document config lifetime and generate-client --status.

Fixes #46.

Behavior

generate-client --status compares current settings with the last successful issue record.

• OpenVPN: endpoint (DNS is pushed live by the server and is not embedded).
• WireGuard: endpoint, canonical DNS, and MTU.
• Legacy clients without evidence are UNKNOWN, never silently CURRENT.
• STALE or UNKNOWN returns a nonzero exit status.

Verification

Focused contract and related tests:

50 passed

New regression coverage:

9 passed

Quality checks:

ruff format --check .  # passed
ruff check .           # passed
git diff --check       # passed
semgrep                 # passed
bandit                  # passed
pip-audit               # passed

Full unit tier:

476 passed, 3 failed

The three failures are pre-existing version-consistency failures tracked by #38: the chart declares v2.1.14 while VERSION and the changelog are at v2.1.15. This change does not touch deployment artifacts, VERSION, or the changelog.

Integration, end-to-end, and Kubernetes tiers were not run locally. gitleaks, hadolint, alint, and droast were unavailable in the local environment; remote CI remains authoritative for those checks.