fix(native-certgen): address Phase 3 validation findings

Remove ENCRYPT/VERIFY from KeyUsage mapping to match Kotlin behavior.
Document BasicConstraints and SKI suppression via rcgen NoCa default.
Fix rotating log off-by-one that kept one extra backup file. Handle
BMPString (UTF-16BE) and VisibleString in X.500 DN parser.

native-certgen/src/logging/rotating.rs

@@ -53,7 +53,12 @@ fn rotate(state: &mut RotatingState) {
     state.current.take();
 
     let dir = &state.dir;
-    // Shift older files up: .{max-1} is deleted, .{N} -> .{N+1}
+    // Delete the oldest rotated file before shifting
+    let oldest = dir.join(format!("certgen.log.{}", state.max_files));
+    if oldest.exists() {
+        let _ = fs::remove_file(&oldest);
+    }
+    // Shift older files up: .{N} -> .{N+1}
     for i in (1..state.max_files).rev() {
         let from = dir.join(format!("certgen.log.{}", i));
         let to = dir.join(format!("certgen.log.{}", i + 1));
@@ -68,12 +73,6 @@ fn rotate(state: &mut RotatingState) {
         let _ = fs::rename(&current_path, &first_rotated);
     }
 
-    // Delete excess files beyond max_files
-    let excess = dir.join(format!("certgen.log.{}", state.max_files + 1));
-    if excess.exists() {
-        let _ = fs::remove_file(&excess);
-    }
-
     let (file, size) = open_current_log(dir);
     state.current = file;
     state.current_size = size;