Include API version in issue summary (#991)

[AcoPiper]

Summary

bootroot registrar issue --json has always carried api_version, but the prose summary printed without --json reported only the identity and the expiry — so an operator who did not ask for a body could not tell which surface version minted the credential.

The issue response's api_version is now passed to the human-summary formatter, and both localized templates render it. The wire token is protocol rather than prose: bootroot.registrar.v1 is substituted unaltered in English and Korean alike, with only the surrounding sentence translated. No CLI flag was added, and issuance, publication, identity composition and the endpoint protocol are untouched. The English and Korean CLI manuals and the changelog entry now describe the non-JSON summary alongside the body.

Two gaps in the surrounding coverage are closed alongside it. The JSON body is now held to being exactly api_version, identity, not_after and no other key, so a field silently gained or renamed fails rather than passing on the strength of the three a caller already knows. And neither issue path held the reported expiry to the certificate it describes: the JSON path asserted only that the instant had not passed yet — any future instant satisfied that — and the prose path did not read it at all. Each now compares the reported value against the notAfter of the leaf the run actually published.

Closes #991

Part of #989

Test plan

• tests/bootroot_registrar.rs::issue_without_json_summarizes_what_it_issued asserts stdout carries the exact bootroot.registrar.v1 token, the composed identity, and an RFC 3339 expiry equal to the published leaf's notAfter.
• src/i18n.rs::registrar_surface_summaries_carry_the_api_version_in_every_locale renders both the capabilities and issue summaries in en and ko, asserting every field substitutes and no placeholder is left behind.
• tests/bootroot_registrar.rs::issue_writes_a_recognized_registrar_client_credential asserts the JSON body's key set is exactly the three fields, in their existing wire spellings.
• cargo test — full suite green.
• cargo fmt -- --check --config group_imports=StdExternalCrate, cargo clippy --all-targets -- -D warnings, RUSTDOCFLAGS=-D warnings cargo doc --no-deps --document-private-items.
• markdownlint-cli2 "**/*.md" and ./scripts/check-docs.sh (mkdocs build --strict plus the theme assertions) for the docs/en/cli.md, docs/ko/cli.md and CHANGELOG.md changes.
• scripts/validate-deploy-compose.sh, validate-compose-instance-names.sh, validate-e2e-openssl-compat.sh, validate-e2e-leftover-check.sh, validate-e2e-run-scope.sh.
• scripts/preflight/ci/e2e-matrix.sh — not run. The change is confined to the prose rendered by registrar issue, its localization tables and its integration coverage; no E2E script invokes that verb, and the Docker lifecycle, rotation, service add/verify, daemon and config paths are untouched. CI's Docker E2E jobs gate it.

[AcoPiper]

[Reviewer Round 1]

Verdict: approve — no findings.

The change correctly routes IssueResponse.api_version into the non-JSON formatter at src/commands/registrar.rs, and both English and Korean templates preserve it as a substituted wire token (en.rs, ko.rs).

Coverage is meaningful: the CLI integration test asserts the exact API token, composed identity, and published leaf’s RFC 3339 expiry (tests/bootroot_registrar.rs); localization coverage exercises both locales and all three issue-summary fields (src/i18n.rs). JSON output remains unchanged and is now held to its exact three-field shape.

PR hygiene is also in order: it closes #991, carries only the inherited Part of #989, includes a test plan, and has no review-thread issue creation.

[AcoPiper]

[Review Verdict Round 1: APPROVED]

[AcoPiper]

Suggested squash commit

Title

Report the surface version in the issue summary

Body

`bootroot registrar issue --json` has always carried `api_version`,
but the prose summary printed without `--json` reported only the
identity and the expiry, so an operator who did not ask for a body
could not tell which surface version minted the credential.

Pass the issue response's `api_version` to the human-summary
formatter and render it in both localized templates. The token is
protocol rather than prose: `bootroot.registrar.v1` is substituted
unaltered in English and Korean alike, with only the surrounding
sentence translated.

Close two gaps in the surrounding coverage alongside it. The JSON
body is now held to being exactly `api_version`, `identity` and
`not_after`, so a field silently gained or renamed fails rather than
passing on the strength of the three a caller already knows. And
neither issue path held the reported expiry to the certificate it
describes — the JSON path asserted only that the instant had not
passed yet, and the prose path did not read it at all — so each now
compares the reported value against the `notAfter` of the leaf the
run actually published.

Closes #991
Part of #989