HTTPS for stateless overlays and phone-home

The stateless overlay client (rollcall-overlay in the compute image)
takes rollcall.tls= and rollcall.ca= like the agents: the CA is accepted
only by its fingerprint and the overlay (munge.key and the like) comes
over HTTPS, with no fallback. A deployed OS calls home over HTTPS when
its rack serves it (it trusts the Rollcall CA from first boot).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/rollcall/deploy.go

@@ -297,7 +297,11 @@ func (a *App) renderSeed(j *Job, sp DeploySpec, token string) []seedFile {
 		if len(sp.Packages) > 0 {
 			fmt.Fprintf(&b, "packages: %s\n", yamlList(sp.Packages))
 		}
-		fmt.Fprintf(&b, "phone_home:\n  url: %s/api/v1/phone-home/%s\n  post: [instance_id, hostname, fqdn, pub_key_ed25519]\n  tries: 10\n", base, token)
+		home := base
+		if t := a.agentTLS(base); t != "" && a.ca != nil {
+			home = t // the deployed OS trusts the Rollcall CA (bootcmd below), so it calls home over HTTPS
+		}
+		fmt.Fprintf(&b, "phone_home:\n  url: %s/api/v1/phone-home/%s\n  post: [instance_id, hostname, fqdn, pub_key_ed25519]\n  tries: 10\n", home, token)
 		b.WriteString("final_message: \"rollcall: deployed, up after $UPTIME s\"\n") // only $UPTIME/$TIMESTAMP/$DATASOURCE/$VERSION are expanded
 		ud = b.String()
 	}