[P1 HTTP] Isolate accepted private-CA profiles on the formal P1 baseline #253

The accepted conformance HTTP contract requires 1–4 explicit PEM roots replacing system trust, bounded input validation, per-profile isolation, hostname verification, and old/new CA overlap. Code exists only on the independent Secret branch (d80b828/7671849e), not formal c942d2f. Reuse only HTTP transport/profile changes, no Secret API merge. Add dedicated loopback HTTPS positive/negative/rotation tests. Source first, private artifacts later; Actions remain off, no main/public release/tag/deployment.