[P1][Post-0.5][Qualification] Isolate the remote-node test topology and complete the trust-negative matrix

[mightnent]

Parent qualification epic: #79

Outcome

Turn the existing split-Compose remote-node qualifier into a reproducible clean-worktree trust-boundary fixture with independent node Docker authority and a complete automated mTLS/token/hostname negative matrix.

Current baseline

The repository already has worktree-scoped Control/node Compose projects, disposable PKI, real mTLS listener tests, topology switching, and node-only socket mounting at the container boundary. Both projects still use one physical Docker Engine, and the full negative matrix is not yet exercised through one qualification fixture.

Execution

• Priority: P1 post-0.5 qualification foundation.
• Deployment profiles: Worktree required; hosted and customer-managed contracts where applicable.
• Worktree boundary: Qualification Compose, isolated Docker daemon/socket, PKI fixtures, trust-negative probes, cleanup, and machine-readable fixture metadata. Avoid product scheduling, provider replacement, and UI.

Scope

• Give the node project its own Docker daemon/socket boundary so Control cannot exercise workspace Docker authority on the shared development machine.
• Generate disposable per-run node and application-relay authorities and leaves without modifying .env.
• Automate valid mTLS plus missing certificate, wrong CA, wrong client identity, wrong token, expired certificate, revoked/retired identity where supported, and wrong server hostname/SAN cases.
• Prove Control/web/ingress do not mount or proxy the node Docker socket/API.
• Bind fixture metadata to the exact Git SHA, rendered topology, and immutable workspace-image digest without recording secrets.
• Make setup and cleanup deterministic from a clean initialized task worktree.

Non-goals

• Production PKI issuance or cloud networking.
• Lifecycle failure injection, browser flows, performance, or multi-node product behavior.
• Adding another workspace provider.

Definition of success

• Separate Control/node projects and a node-only Docker daemon pass reproducibly from a clean task worktree.
• Valid mTLS and every named certificate, identity, token, expiry, and hostname negative case are automated.
• Control, web, and ingress have no Docker socket or remote Docker API authority.
• Cleanup removes only qualification-owned containers, networks, daemon state, and PKI while preserving worktree databases and workspace volumes.
• Fixture output is machine-readable, secret-free, and tied to the exact SHA and image digest.
• Focused qualification tests and npm run verify:quick pass on the exact candidate SHA.