fix(cert): reject mismatched CA keys

[kvinwang]

Problem

Certificate tooling accepted a CA certificate and private key independently without proving they matched. It could issue leaves signed by a key that did not correspond to the advertised CA, so clients rejected the chain.

Root cause and fix

Compare the derived public keys before signing and reject a mismatched CA certificate/key pair.

Implementation

The branch records the following focused implementation work:

• fix(cert): reject mismatched CA key

Changed paths:

• dstack/ra-tls/src/cert.rs

Scope

This PR addresses one logical cert finding. It intentionally excludes the acceptance-test infrastructure from #841 and unrelated product fixes from #840.

Dependency and merge order

This PR is based directly on master and does not require another split product PR to merge first.

Verification

• git diff --check origin/master..origin/codex/fix-ra-tls-ca-key-match: passed.
• The declared base was verified as an ancestor of the PR head.
• Focused compile/check verification was run for the changed component where applicable; non-Rust packaging or configuration changes were reviewed against their exact branch delta.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.