Add renewed certificate lifecycle commands

[kemsta]

Summary

• add public PKI.ShowRenewed and transactional PKI.RevokeRenewed methods
• report both renewed/issued and historical renewed/certs_by_serial archives through filesystem, memory, and legacy backends
• preserve renewal source through snapshots and keep historical records report-only with RequiresRewind
• add thin show-renew and revoke-renewed CLI adapters
• support Easy-RSA's certificateHold reason through API, index, CLI, and CRL
• raise the verified Easy-RSA v3.2.6 matrix from 34/10 to 36 commands verified / 8 deferred

Lifecycle guarantees

• user-facing renewal status derives from the archived certificate's actual expiry
• renewed revocation preserves the current replacement certificate, private key, and CSR
• archive movement, artifact cleanup, and index mutation share one backend transaction
• revoke does not generate or change a CRL; gen-crl remains explicit
• historical serial archives are shown with *** and cannot be revoked without an external rewind

Verification

• all four modules: tests and vet on Go 1.25.13 and 1.26.6
• root and CLI authoritative E2E against pinned Easy-RSA v3.2.6 on both toolchains
• storage, PKI, and CLI race suites
• root and CLI golangci-lint v2.12.2
• govulncheck v1.7.0 in all four modules
• actionlint, module tidy/verify, and no-replace checks
• Windows, Linux, and AIX compilation
• standalone go install plus renew/show/revoke/CRL smoke test

No tag or release is included.