Please address the comments from this code review:

## Overall Comments
- In `install_capsule_foremanctl`, `cer_source` and `hostname` are required for the `foremanctl certificate-bundle` command but default to `None` and are never passed from the fixture, which will cause a failure when `" ".join(cer_source)` is called; consider making them required parameters and validating them before use.
- The new upstream-specific branch in `setup_capsule_repos` is not used by `install_capsule_foremanctl`, which currently calls `setup_satellite_repos`; verify whether Capsule installs should instead call `setup_capsule_repos` so the upstream Capsule repo setup logic is actually exercised.

## Individual Comments

### Comment 1
<location path="robottelo/hosts.py" line_range="2041-2050" />
<code_context>
+        cer_source=None,
</code_context>
<issue_to_address>
**issue (bug_risk):** Handle `cer_source` more defensively before joining it into the command.

`cer_source` can be `None`, but later you call `" ".join(cer_source)`, which will fail if it’s `None` or not an iterable of strings. Either make `cer_source` required (and document it as a list/tuple of strings), or add validation and raise a clear error if it’s missing/invalid.
</issue_to_address>

### Comment 2
<location path="robottelo/hosts.py" line_range="2042-2051" />
<code_context>
+        hostname=None,
</code_context>
<issue_to_address>
**issue (bug_risk):** Avoid passing a `None` hostname through to the `foremanctl certificate-bundle` command.

If `hostname` remains `None`, the command will literally include `None`, which is likely invalid and hard to diagnose. Please either require `hostname` or validate it before constructing the command and fail fast with a clear error if it’s missing or empty.
</issue_to_address>

### Comment 3
<location path="tests/foreman/installer/test_install_foremanctl.py" line_range="211" />
<code_context>
+    capsule = module_capsule_foremanctl_custom_certs
+    common_sat_install_assertions(capsule)
+    # check the services are up and healthy
+    result = capsule.execute('hammer ping')
+    assert result.status == 0
+    assert result.stdout.count('Status:') == result.stdout.count(' ok')
</code_context>
<issue_to_address>
**issue (testing):** The test does not assert that the served certificate CN matches the Capsule hostname as described in the PR.

This test only checks `hammer ping` and an HTTPS 200 with the custom CA. Please add an assertion that inspects the server certificate CN (for example via `openssl s_client` or `curl --resolve` with verbose output) and verifies it equals `capsule.hostname`, so the test confirms the expected certificate is actually presented for that hostname.
</issue_to_address>

### Comment 4
<location path="robottelo/hosts.py" line_range="2079-2082" />
<code_context>
            self.execute(
                f'foremanctl certificate-bundle --certificate-source {" ".join(cer_source)} {hostname} ',
                timeout='30m',
            ).status
</code_context>
<issue_to_address>
**security (python.sqlalchemy.security.sqlalchemy-execute-raw-query):** Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

*Source: opengrep*
</issue_to_address>

### Comment 5
<location path="robottelo/hosts.py" line_range="2096-2099" />
<code_context>
            self.execute(
                f'foremanctl deploy {" ".join(default_parameters)}',
                timeout='30m',
            ).status
</code_context>
<issue_to_address>
**security (python.sqlalchemy.security.sqlalchemy-execute-raw-query):** Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

*Source: opengrep*
</issue_to_address>