feat: display top-level certificate extensions

[danielewood]

Summary

• display every top-level X.509 certificate extension in inspect output and verbose verify/connect output
• resolve well-known extension OIDs with a much broader Apple/vendor registry and vendor-arc fallbacks
• add coverage for extension collection, formatting, docs, and changelog updates

Testing

• pre-commit run --all-files
• gopls check dn.go internal/format.go internal/inspect.go internal/verify.go cmd/certkit/connect.go cmd/certkit/root.go

[Copilot]

Pull request overview

Adds visibility into all top-level X.509 certificate extensions across the CLI/library outputs, including human-friendly OID name resolution and critical/unhandled markers.

Changes:

• Add certkit.CertificateExtension plus CollectCertificateExtensions and a broad extension OID name registry (with vendor-arc fallbacks).
• Surface extension summaries in inspect output and verbose verify / connect outputs (text + JSON), with new formatting helpers.
• Add/extend tests and update docs + architecture notes + changelog entry for the new output fields.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/verify_test.go	Adds coverage ensuring verbose verify results include collected extensions (including unhandled critical).
internal/verify.go	Populates and formats extension lists in verbose verify output for leaf + chain entries.
internal/inspect_test.go	Extends inspect output tests (text + JSON) to assert extension rendering/serialization.
internal/inspect.go	Collects and prints extensions for certificate inspect results.
internal/format.go	Introduces shared internal formatter for extension blocks/flags (used by inspect/verify).
dn_test.go	Adds tests for extension collection and OID-to-name resolution (including vendor fallbacks).
dn.go	Adds extension model + OID registry + name resolution + collection helper to the public library.
cmd/certkit/root.go	Updates --verbose help text to mention extensions.
cmd/certkit/connect_test.go	Extends connect verbose output test to assert extensions are included.
cmd/certkit/connect.go	Adds extensions to verbose connect JSON and text output; adds connect-local extension formatting helpers.
README.md	Updates global-flag docs to mention extensions in verbose output.
EXAMPLES.md	Updates verbose-mode documentation to include extension summaries.
CHANGELOG.md	Notes new extension display behavior under Unreleased.
.claude/docs/architecture.md	Updates architecture documentation to reflect extension summaries in inspect/verify/connect.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.