Fix MITM CA generation for Azure CLI trust

[jimpudar]

Summary

• Add SKI and AKI to the per-instance MITM CA so stricter Python/OpenSSL verification accepts it.
• Repair legacy per-instance CA certs on startup and force reprovision when the CA changes.
• Add regression coverage for legacy CA repair and keep the existing spy path on the current cert format.

Testing

• Unit tests passed for the rootcell suite, including the new CA repair regression.
• Full Vitest unit project passed.