Implement privileged first-party issuance path (core + core-bundled apps)

Summary

The self-service issuer bot cannot issue leaves for core and the 12 core-bundled apps, because they have no standalone repo with a root appinfo/info.xml to run the nonce challenge against. These are first-party identities that need the privileged first-party issuance path described in the PKI design §15 ("Model A") / §19 Phase 5 — which is not implemented.

The 13 identities

core + comments, dav, federatedfilesharing, federation, files, files_external, files_sharing, files_trashbin, files_versions, provisioning_api, systemtags, updatenotification — all live inside owncloud/core (apps/<id>/appinfo/info.xml), not standalone owncloud/<id> repos; core has no app id.

Why the issuer bot can't do it

internal/enroll/enroll.go calls GetFile(f.Repo, "appinfo/info.xml") (fixed root path) and proves control via a per-repo nonce commit. Neither works for an app whose info.xml is nested inside owncloud/core, nor for core (no info.xml). Verified: owncloud/files, owncloud/dav, etc. return 404 (no standalone repos).

Ask

Implement a privileged, org-gated issuance path (sibling to privileged-revocation.yml / cmd/privrevoke): a workflow_dispatch-only workflow that takes a CSR (or appId + CSR), skips the nonce/repo challenge (control proven by the org-member dispatch gate per design §11/§15), and issues the leaf reusing internal/certtmpl.Leaf + internal/signer under the real intermediate. Should also seed the reserved ledger/<id>.json entries (design §15 / §19 Phase 5).

Context

Needed to complete G2 signing-cert enrollment for the oc11 (11.0.0-rc1) release. The 44 standalone first-party apps go through the normal issuer bot (currently blocked separately by owncloud/admin#211 — bypass actor not live). Key+CSR material for all 13 is already staged in the signing key store; a handoff note with the exact leaf profile accompanies it there.

Start with the PKI design sections 11, 15, and 19, then inspect internal/enroll/enroll.go, privileged-revocation.yml, and cmd/privrevoke. Trace how internal/certtmpl.Leaf and internal/signer are used under the real intermediate. Done means an org-gated workflow_dispatch path issues the 13 first-party leaves without the nonce challenge and seeds the reserved ledger entries.