fix(hosts): make identity persistence durable and check the CA file #86

Three small gaps in apps/host_agent/internal/identity/identity.go:

1. Prepare creates the identity directory with Mkdir (around line 77) but never fsyncs its parent. After power loss the pending key can vanish, breaking "Persist pending key/CSR before redemption" in host-enrollment.md.
2. On the exclusive link path (around lines 143 and 157-173), the .identity-* temp name is removed after the directory fsync and that removal is never synced. A crash can leave a second copy of the private key.
3. The server CA file (around lines 434-449) is checked for symlinks and size only. A group- or world-writable CA file can be replaced to impersonate the control plane.

Acceptance criteria

• The parent directory is fsynced after a successful Mkdir.
• The temp name is removed before the directory fsync on the link path.
• The CA file must be owned by root or the agent's user and not group/other-writable; its path is validated as absolute and clean in Prepare and validate.
• Tests cover the refusals; make check is green.

Found by the independent pilot review on 2026-10-16. Builds on the pilot branch pilot/installable-pilot-pr (split from #83); start from its current head.

🤖 Generated with Claude Code