feat(build): mTLS for buildkitd + public exposure via TLS passthrough

cert-manager self-signed CA issues server and client certs for BuildKit
mTLS. Buildkitd serves TLS on its ClusterIP (hostNetwork removed) and
is publicly reachable at build.DOMAIN_SUFFIX:443 through Pingora's new
SNI-based TLS passthrough router. Clients authenticate with the client
certificate from the buildkitd-client-tls secret.

base/build/buildkitd-mtls.yaml

@@ -0,0 +1,93 @@
+# mTLS certificate infrastructure for BuildKit.
+#
+# Self-signed CA → server cert (for buildkitd) + client cert (for CLI).
+# This allows buildkitd to be publicly exposed through Pingora's TLS
+# passthrough while requiring client certificate authentication.
+#
+# cert-manager must be installed before applying this.
+---
+# ── CA Issuer ────────────────────────────────────────────────────────────────
+# Self-signed issuer bootstraps the CA keypair.
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: buildkit-selfsign
+  namespace: build
+spec:
+  selfSigned: {}
+---
+# CA certificate — signs both server and client certs.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: buildkit-ca
+  namespace: build
+spec:
+  isCA: true
+  commonName: buildkit-ca
+  secretName: buildkit-ca-keypair
+  duration: 87600h    # 10 years
+  renewBefore: 8760h  # renew 1 year early
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: buildkit-selfsign
+    kind: Issuer
+---
+# Issuer that signs certs using the CA above.
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: buildkit-ca-issuer
+  namespace: build
+spec:
+  ca:
+    secretName: buildkit-ca-keypair
+---
+# ── Server certificate (for buildkitd) ──────────────────────────────────────
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: buildkitd-server
+  namespace: build
+spec:
+  secretName: buildkitd-server-tls
+  duration: 8760h     # 1 year
+  renewBefore: 720h   # renew 30 days early
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  usages:
+    - digital signature
+    - key encipherment
+    - server auth
+  dnsNames:
+    - buildkitd
+    - buildkitd.build.svc.cluster.local
+    - build.DOMAIN_SUFFIX
+  issuerRef:
+    name: buildkit-ca-issuer
+    kind: Issuer
+---
+# ── Client certificate (for Sunbeam CLI) ────────────────────────────────────
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: buildkitd-client
+  namespace: build
+spec:
+  secretName: buildkitd-client-tls
+  duration: 8760h
+  renewBefore: 720h
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  usages:
+    - digital signature
+    - key encipherment
+    - client auth
+  commonName: sunbeam-cli
+  issuerRef:
+    name: buildkit-ca-issuer
+    kind: Issuer