Renew registrar leaves and reload TLS (#768)

[sehkone]

Summary

• Adds the daemon-owned renewal adapter for registrar client and server leaves, initializes their shared state, and joins it during shutdown.
• Stages candidate issuance and validates identity, pinned server chains, post-merge trust, and the replacement TLS configuration before transactional publication.
• Atomically publishes renewed material, swaps the active acceptor only on success, and preserves per-dial torn-pair retry semantics.
• Documents the reload contract in English and Korean.

Closes #768. Part of #770.

Test plan

• Exercise enabled and disabled adapter lifecycle, immediate ticks, renewal-state initialization, and no-AppRole behavior.
• Exercise lead-time and chain-drift eligibility, fresh-key candidate validation, pin-file refusal, and exact incoming-verifier trust inputs.
• Exercise transactional publication, rollback paths, active-acceptor replacement, and continued mTLS without socket replacement.
• Exercise per-dial client reload plus deterministic torn-pair retry and exhaustion behavior.
• Build English and Korean documentation with strict MkDocs validation.
• Run scripts/preflight/run-all.sh: CI-equivalent checks, core tests, and the no-hosts Docker E2E matrix arm passed.
• Run the hosts Docker E2E matrix arm: it requires passwordless sudo -n, which is unavailable in this environment; CI will gate it.