feat(directive): implement BRIDGE-WP-0004 AccessManagementDirective alignment

- ActorType enum (adm/agt/atm) replaces actor_class string; config validates
  naming convention (adm-*/agt-*/atm-*) with hard ConfigError on mismatch;
  legacy 'human'/'automation' values accepted with DeprecationWarning
- cert_command: pluggable shell string run before each SSH launch; cert written
  to state dir; -i cert appended to SSH command alongside -i key
- TTL-aware cert refresh: parses Valid-to via ssh-keygen -L; pre-emptive restart
  5 min before expiry (no backoff, no attempt increment); CERT_EXPIRING logged
- CertAcquisitionError: cert failures trigger normal backoff/retry loop
- cert_identity: Key ID parsed from cert and recorded in BRIDGE_CONNECTED event
- bridge cert-status: new CLI command; exit 1 on expired cert; --json flag
- 233 tests passing, ruff clean

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_integration.py

@@ -18,14 +18,14 @@ MINIMAL_CONFIG = textwrap.dedent("""\
         local_port: 8000
         ssh_user: testuser
         ssh_key: ~/.ssh/id_rsa
-        actor: operator.bernd
+        actor: adm-bernd
         reconnect:
           max_attempts: 2
           backoff_initial: 1
           backoff_max: 2
     actors:
-      operator.bernd:
-        class: human
+      adm-bernd:
+        class: adm
         description: Bernd
 """)
 
@@ -51,7 +51,7 @@ def tunnel_cfg():
         local_port=8000,
         ssh_user="testuser",
         ssh_key="~/.ssh/id_rsa",
-        actor="operator.bernd",
+        actor="adm-bernd",
         reconnect=ReconnectPolicy(max_attempts=2, backoff_initial=1, backoff_max=2),
     )
 
@@ -142,7 +142,7 @@ class TestHealthCheckDegradedPath:
             local_port=8001,
             ssh_user="u",
             ssh_key="k",
-            actor="operator.bernd",
+            actor="adm-bernd",
             reconnect=ReconnectPolicy(max_attempts=1, backoff_initial=1, backoff_max=1),
             health_check=hc_cfg,
         )