734c9fa0fa
internal/identity/spiffe.go: SpiffeURI format + MintSVID via step CLI; internal/identity/spiffe_test.go: mock-transport tests with self-signed SPIFFE URI SAN cert. Spike passes: step CLI supports --san with URI SANs. Fallback to mTLS identity NOT needed. ---ci--- project: orca phase: 01.5 milestone: v0.11 status: execute ---/ci---