Milestone 6: root CA generated, snakeoil intermediate embedded, DER parser

Root CA + snakeoil intermediate generated entirely offline
(/home/rajames/CLionProjects/lithosananke-ca/, outside this repo,
private keys chmod 600) per this milestone's own requirement: Ed25519,
root self-signed 20-year validity, intermediate real-CA-signed
(CA:TRUE, pathlen:0), chain verified via openssl.

Snakeoil intermediate embedded as a capsule (capsules/pki/
snakeoil-intermediate.der) -- confirmed the font-capsule precedent
needed zero new infrastructure, any non-.4th file under capsules/
embeds verbatim already.

New x509_ed25519.c: a from-scratch, narrow DER walker (not general
ASN.1/X.509, per this milestone's design decision) extracting the raw
Ed25519 pubkey from a cert's SubjectPublicKeyInfo -- handles the
optional v3 version field, verifies the AlgorithmIdentifier OID is
Ed25519 rather than assuming, handles both DER length forms. Verified
against ground truth: the extracted key from the real embedded cert
matches openssl's own reported pubkey byte-for-byte; refusal path
checked against truncated/garbage/empty/wrong-algorithm (real RSA cert)
input. Compiles clean on all three architectures.

Still open: mkcapsule signing step, wiring ed25519_verify() into
capsule_birth.c's three validate call sites (landing warn-only first,
per decision -- a bug here could stop every capsule from birthing,
including Mama's own, on all three arches), and the BLOCK_MAP.md
signature-status column. Documented in FABRIC-3.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U14ET9CWAtbQMbYqomKgXd

FABRIC-3.md

@@ -696,6 +696,54 @@ decisions get added here, not to `FABRIC-2.md`. Follow the same discipline `FABR
 - [ ] Implement magic-number-based content-type detection (Section U item 14) — a shared
   primitive, also usable for Milestone 4's foreign-drive check.
 
+- [x] **Root CA + snakeoil intermediate generated 2026-08-26**, entirely offline, in a sibling
+  directory outside this repo (`/home/rajames/CLionProjects/lithosananke-ca/`, not tracked by
+  git here). Ed25519, OpenSSL 3.5.5. Root: self-signed, 20-year validity (2026–2046),
+  `CN=LithosAnanke Root CA`. Intermediate: a real CA-signed cert (not self-signed despite the
+  name), 10-year validity, `CA:TRUE, pathlen:0` (can sign capsules, can't mint further
+  intermediates), chain verified (`openssl verify` returns `OK`). Both private keys `chmod
+  600`. The root key never touches this repo or any kernel code, per the design's own
+  requirement.
+
+- [x] **Snakeoil intermediate embedded as a capsule, 2026-08-26.** Exported to DER
+  (`capsules/pki/snakeoil-intermediate.der`, 418 bytes) and dropped under `capsules/` —
+  confirmed the font-capsule precedent needed zero new infrastructure: `mkcapsule`'s
+  `process_file()` embeds any non-`.4th` file verbatim already. Shows up as capsule
+  `pki:snakeoil-intermediate.der` in the generated capsule table (38 capsules total, up from
+  37) — retrieve via `capsule_find_by_name()` + `capsule_get_payload()`, never
+  `capsule_exec_payload()` (it's a passive data blob, not executable capsule code).
+
+- [x] **Minimal DER/X.509 parser written and independently verified, 2026-08-26.** New
+  `include/starkernel/x509_ed25519.h` + `src/starkernel/crypto/x509_ed25519.c`:
+  `x509_extract_ed25519_pubkey()`, a from-scratch, narrow DER walker (not a general ASN.1/
+  X.509 parser, per this milestone's own design decision) — walks `Certificate →
+  TBSCertificate → SubjectPublicKeyInfo`, handles the optional `[0] EXPLICIT Version` field
+  (present on v3 certs), verifies the `AlgorithmIdentifier` OID is exactly `1.3.101.112`
+  (RFC 8410 Ed25519) rather than assuming, and extracts the raw 32-byte key from the trailing
+  `BIT STRING`. Handles both short-form and long-form DER lengths (a real cert with v3
+  extensions routinely exceeds the 127-byte short-form limit). Every step bounds-checked
+  against the buffer end — refuses malformed input, never faults.
+
+  **Verified against ground truth, not self-consistency:** run against the real embedded
+  `snakeoil-intermediate.der`, the extracted 32-byte key matched `openssl pkey -pubin -text`'s
+  own reported public key byte-for-byte. Refusal path verified too: truncated input, 10 random
+  garbage bytes, an empty file, and a real RSA certificate (algorithm-mismatch case, not just
+  structural malformation) all correctly return failure rather than misreading or crashing.
+  Compiles clean on all three kernel architectures (no `__STARKERNEL__` guard needed — same
+  freestanding-safe shape as the other crypto files).
+
+  **Still open:** the signing step in `mkcapsule` (needs a new `sig[64]` field on
+  `CapsuleEntry` and a parallel emitted array in `capsule_generated.c`, since `CapsuleDesc`
+  itself has no spare bytes — confirmed exactly 64 bytes, every field used), wiring
+  `ed25519_verify()` into the three `capsule_validate()` call sites in `capsule_birth.c`
+  (**decided: land as WARN-only first, prove correct on all three architectures against both a
+  valid and a deliberately-corrupted capsule, then flip to hard-refuse in a separate step** —
+  a bug here has a much larger blast radius than anything else in Phase 8, since a false
+  refusal on Mama's own capsule means no `ok>` at all, on any architecture), and the
+  signature-status column on `capsules/BLOCK_MAP.md` (confirmed the real, live manifest target
+  — `capsules/MANIFEST_AUTO.md` is stale/dead, not regenerated since 2026-07-05, flag as docs
+  drift rather than a real target).
+
 ### From FABRIC-2.md §X, Milestone 7 — Contributor capsules / trust tiers
 
 - [ ] Create the `capsules/contrib/` directory (mechanically trivial, matches existing