feat(native-certgen): implement X.509 certificate chain builder

Builds v3 leaf certificate with attestation extension and KeyUsage,
signs with keybox private key via rcgen 0.13.2. Assembles full chain
(leaf + keybox intermediates + root). Supports EC and RSA keybox
signing keys. Uses rcgen's signed_by() with a synthesized issuer
Certificate, no manual DER fallback needed.

native-certgen/src/lib.rs

@@ -3,4 +3,5 @@ mod types;
 mod keygen;
 pub mod keybox;
 pub mod attestation;
+pub mod certbuilder;
 pub mod logging;