feat(admin-config-tool): drop ha/data/ entirely, match real client TLS

deploy-ha.sh no longer takes a <data-dir> argument or --build-config
flag. Every deploy now generates a fresh self-signed TLS cert/key
(openssl, RSA 2048, 10y validity) directly into the deploy dir's
certs/, and builds cluster.bin directly into controller/ctrl-1/conf/
via xceadmin -- no intermediate staging directory, nothing preserved
across runs. run-ha-soak.sh (/xce-test-ha) updated to match: dropped
its own XCE_HA_DATADIR-based precondition entirely. Updated 4 callers
(run-ha-soak.sh, test-heartbeat-tolerance.sh, test-commit-durability.sh,
both xce-deploy-ha/xce-test-ha SKILL.md docs).

Separately: xcecommon.wire.connect() was loading a client-side TLS
cert, diverging from the real reference client -- netio.c's
create_ssl_context() presents no certificate at all when acting as a
client (cert_file/key_file both NULL, bare TLS_client_method()).
Fixed connect() to match, and since nothing else consumed cert_dir
(verify_mode=CERT_NONE throughout, no CA check either), removed it
end-to-end: discovery.follow_redirects(), push.push_config()/
probe_config(), and the --cert-dir CLI flag.

Server-side cert loading (mock TLS test servers) is unaffected --
moved into a shared session-scoped tls_certs fixture (new
tests/conftest.py, openssl-generated) replacing 3 duplicated
REPO_HA_DATA_DIR/skipif blocks. Net result: those tests no longer skip
under a hermetic nix build sandbox (which never had ha/data/) --
verified 165/165 passed, 0 skipped, via both meson compile and a full
nix build --option sandbox false .#xcecore_debug rebuild (previously
128 passed / 37 skipped there).

ha/data/{xce.crt,xce.key} removed from git tracking. Requirements
2.3/2.4 and 8.3/8.4/8.5 marked superseded in requirements.md with
dated correction notes.

src/tools/deploy-ha.sh

@@ -3,57 +3,46 @@ set -e
 
 SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 
-# --build-config may appear anywhere among the positional args.
-BUILD_CONFIG=0
-ARGS=()
-for arg in "$@"; do
-    if [ "$arg" = "--build-config" ]; then
-        BUILD_CONFIG=1
-    else
-        ARGS+=("$arg")
-    fi
-done
+BINARY=$1
+TOP=$2
+PEERS=$3
 
-BINARY=${ARGS[0]}
-DATADIR=${ARGS[1]}
-TOP=${ARGS[2]}
-PEERS=${ARGS[3]}
-
-if [ -z "$BINARY" ] || [ -z "$DATADIR" ] || [ -z "$TOP" ] || [ -z "$PEERS" ]; then
-    echo "Usage: $0 [--build-config] <binary> <data-dir> <top-dir> <peers>"
-    echo "  --build-config: rebuild <data-dir>/cluster.bin from configs/ before deploying,"
-    echo "                  even if one already exists"
+if [ -z "$BINARY" ] || [ -z "$TOP" ] || [ -z "$PEERS" ]; then
+    echo "Usage: $0 <binary> <top-dir> <peers>"
     echo "  peers: comma-separated host:port list (e.g. host1:port1,host2:port2)"
+    echo "  TLS cert/key and cluster.bin are generated fresh into <top-dir> every"
+    echo "  run (openssl self-signed cert; cluster.bin via xceadmin from"
+    echo "  src/configs/*.yaml) -- no pre-existing data directory needed."
     exit 1
 fi
 
 BINARY=$(realpath "$BINARY")
 
-# Requirements 8.3/8.4/8.5: rebuild cluster.bin when --build-config is
-# passed or none exists yet; otherwise leave an existing one untouched.
-if [ "$BUILD_CONFIG" = "1" ] || [ ! -f "$DATADIR/cluster.bin" ]; then
-    # xceadmin is meson-built now (src/xceadmin/meson.build), not a plain
-    # `pip install -e .` venv checked out under src/xceadmin/ -- its build
-    # output lives under whichever meson build dir xce-build.sh's profile
-    # picked, or under a nix-installed prefix's bin/. Try each in turn.
-    XCEADMIN=""
-    for candidate in \
-        "$SCRIPT_DIR/../xce.build/xceadmin/.venv/bin/xceadmin" \
-        "$SCRIPT_DIR/../build.release/xceadmin/.venv/bin/xceadmin" \
-        "$SCRIPT_DIR/../build.dbg/xceadmin/.venv/bin/xceadmin" \
-        "$SCRIPT_DIR/../result/bin/xceadmin" \
-        "$(command -v xceadmin 2>/dev/null || true)"
-    do
-        if [ -n "$candidate" ] && [ -x "$candidate" ]; then
-            XCEADMIN="$candidate"
-            break
-        fi
-    done
-    if [ -z "$XCEADMIN" ]; then
-        echo "Error: xceadmin binary not found -- run 'xce-build.sh xceadmin' or 'nix build .#xcecore' first"
-        exit 1
+# xceadmin is meson-built now (src/xceadmin/meson.build), not a plain
+# `pip install -e .` venv checked out under src/xceadmin/ -- its build
+# output lives under whichever meson build dir xce-build.sh's profile
+# picked, or under a nix-installed prefix's bin/. Try each in turn.
+XCEADMIN=""
+for candidate in \
+    "$SCRIPT_DIR/../xce.build/xceadmin/.venv/bin/xceadmin" \
+    "$SCRIPT_DIR/../build.release/xceadmin/.venv/bin/xceadmin" \
+    "$SCRIPT_DIR/../build.dbg/xceadmin/.venv/bin/xceadmin" \
+    "$SCRIPT_DIR/../result/bin/xceadmin" \
+    "$(command -v xceadmin 2>/dev/null || true)"
+do
+    if [ -n "$candidate" ] && [ -x "$candidate" ]; then
+        XCEADMIN="$candidate"
+        break
     fi
-    "$XCEADMIN" config build "$SCRIPT_DIR/../configs" -o "$DATADIR/cluster.bin"
+done
+if [ -z "$XCEADMIN" ]; then
+    echo "Error: xceadmin binary not found -- run 'xce-build.sh xceadmin' or 'nix build .#xcecore' first"
+    exit 1
+fi
+
+if ! command -v openssl >/dev/null 2>&1; then
+    echo "Error: openssl not found -- run under 'nix develop' (provides openssl on PATH)"
+    exit 1
 fi
 
 IFS=',' read -ra PEER_ARRAY <<< "$PEERS"
@@ -68,13 +57,22 @@ for i in $(seq 1 $N); do
     mkdir -p "$TOP/controller/ctrl-$i/data"
 done
 
-# Copy certificates
-cp "$DATADIR/xce.crt" "$TOP/certs/"
-cp "$DATADIR/xce.key" "$TOP/certs/"
+# Self-signed dev/test TLS cert+key, generated fresh directly into the
+# deployment dir every run -- nothing checked into git, nothing shared
+# across deploys. Long-lived (10y) since it's regenerated per deploy
+# anyway; TLS verification is SSL_VERIFY_NONE everywhere in this codebase
+# (no hostname/identity check), so a fresh self-signed pair per run loses
+# no real security property versus a long-lived shared one.
+openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
+    -keyout "$TOP/certs/xce.key" -out "$TOP/certs/xce.crt" \
+    -subj "/CN=xce-dev-test" 2>/dev/null
 
-# Tag and copy cluster.bin
-TAG=$(sha256sum "$DATADIR/cluster.bin" | cut -c1-12)
-cp "$DATADIR/cluster.bin" "$TOP/controller/ctrl-1/conf/cluster.bin.$TAG"
+# Build cluster.bin from src/configs/*.yaml via xceadmin, straight into
+# this deploy's own ctrl-1/conf/ (no intermediate data-dir copy).
+CLUSTER_BIN_TMP="$TOP/.cluster.bin.tmp"
+"$XCEADMIN" config build "$SCRIPT_DIR/../configs" -o "$CLUSTER_BIN_TMP"
+TAG=$(sha256sum "$CLUSTER_BIN_TMP" | cut -c1-12)
+mv "$CLUSTER_BIN_TMP" "$TOP/controller/ctrl-1/conf/cluster.bin.$TAG"
 echo "cluster.bin.$TAG" > "$TOP/controller/ctrl-1/conf/current"
 
 # Build peers string: ctrl-1=host1:port1,ctrl-2=host2:port2,...

src/tools/test-commit-durability.sh

@@ -95,7 +95,6 @@ fi
 WORKTREE=$(cd "$(dirname "$0")/../.." && pwd)
 BINARY="$WORKTREE/src/xce.build/controller/xce_controller"
 XCE_TEST="$WORKTREE/src/xce.build/controller/xce_test"
-DATADIR="$WORKTREE/ha/data"
 DEPLOY_DIR="${1:-/tmp/xce-ha-deploy}"
 ROUNDS="${2:-8}"
 PEERS="localhost:9991,localhost:9992,localhost:9993"
@@ -151,7 +150,7 @@ deploy_cluster() {
         exit 2
     fi
     yellow "Deploying 3-node cluster to $DEPLOY_DIR ..."
-    bash "$WORKTREE/src/tools/deploy-ha.sh" "$BINARY" "$DATADIR" "$DEPLOY_DIR" "$PEERS"
+    bash "$WORKTREE/src/tools/deploy-ha.sh" "$BINARY" "$DEPLOY_DIR" "$PEERS"
 }
 
 start_node() {

src/tools/test-heartbeat-tolerance.sh

@@ -17,7 +17,6 @@ set -e
 
 WORKTREE=$(cd "$(dirname "$0")/../.." && pwd)
 BINARY="$WORKTREE/src/xce.build/controller/xce_controller"
-DATADIR="$WORKTREE/ha/data"
 DEPLOY_DIR="${1:-/tmp/xce-deploy}"
 PEERS="localhost:9991,localhost:9992,localhost:9993"
 LOGDIR="$DEPLOY_DIR/logs"
@@ -48,7 +47,7 @@ deploy_cluster() {
     fi
     yellow "Deploying 3-node cluster to $DEPLOY_DIR ..."
     bash "$WORKTREE/src/tools/deploy-ha.sh" \
-        "$BINARY" "$DATADIR" "$DEPLOY_DIR" "$PEERS"
+        "$BINARY" "$DEPLOY_DIR" "$PEERS"
 }
 
 start_cluster() {