chore: merge develop into main

[Copilot]

Promotes the develop branch into main, bringing robustness improvements to SQLite publish atomicity, AIA chain resolution, MemStore concurrency safety, and WASM export UX.

SQLite atomic publish (internal/certstore/sqlite.go)

• Hard-link staging is the sole publish path for hard-link-capable filesystems; rename-based fallback removed
• Cleanup failures (rollback defer, post-chmod removal) now logged via slog.Warn instead of silently discarded (ERR-5)
• os.ErrExist returned only for true concurrent-write races; re-save to existing path works correctly

WASM export (cmd/wasm/main.go)

• Replaced CLI-oriented DefaultExportPasswordWarning with wasmDefaultExportPasswordWarning — directs browser callers to pass a password to certkitExportBundles rather than referencing --passwords/--password-file flags

AIA / chain resolution

• ResolveAIA returns ResolveAIAResult (structured: Warnings, FetchedCount, Incomplete, UnresolvedCount) instead of a flat []string
• fetchAIACertificatesDetailed early-return on MaxTotalCerts now returns a properly populated aiaFetchCertificatesResult
• ResolveAIA de-duplication uses a locked MemStore helper instead of direct map access (fixes data race under concurrent store operations)

MemStore concurrency (internal/certstore/memstore.go)

• All public methods acquire RWMutex; direct field access paths removed

Bundle chain verification (bundle.go)

• AIA-incomplete error path summarizes only the AIA fetch warnings, not the full result warning set

Test Plan

• All TestSaveToSQLite_* tests pass, including new TestSaveToSQLite_ReplaceRaceKeepsCompetingWriterWhenHardLinksUnsupported
• WASM module builds clean (GOOS=js GOARCH=wasm go build ./cmd/wasm/...)
• go vet ./... clean

Checklist

• Commit messages follow Conventional Commits
• CHANGELOG.md updated (if user-facing change)
• Exported functions have doc comments

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[danielewood]

Superseded by #166 and subsequent develop updates.