Add generation-bound TLS control face

Create ephemeral trust anchors, publish an exact-profile Unix control socket, and persist generation-authorized mTLS session registration through the Domain Store.

crates/lazaret-core/src/records/credentials.rs

@@ -197,6 +197,44 @@ pub struct ProtocolPublicationIdentity {
     pub coordinator_tls_certificate_sha256: CertificateDigest,
 }
 
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct ClientEnrollmentRequest {
+    pub protocol_version: ProtocolVersion,
+    pub generation_identity: GenerationIdentity,
+    pub cli_id: ClientId,
+    pub certificate_signing_request_der: Vec<u8>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct ClientEnrollmentResponse {
+    pub protocol_version: ProtocolVersion,
+    pub credential: TlsCredential,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct SessionRegistrationRequest {
+    pub protocol_version: ProtocolVersion,
+    pub session_binding: SessionBinding,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct SessionRegistrationResponse {
+    pub protocol_version: ProtocolVersion,
+    pub session_capability: SessionRequestCapability,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub enum ControlRequest {
+    Enroll(ClientEnrollmentRequest),
+    Register(SessionRegistrationRequest),
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub enum ControlResponse {
+    Enrolled(ClientEnrollmentResponse),
+    Registered(SessionRegistrationResponse),
+}
+
 #[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
 pub enum ProtocolCredentialRole {
     SessionCoordinator,