Publish SSH certificate issuance capability registry entry

Add capability.security.ssh-certificate-issuance to the federation index
with maturity vector D4/A3/C3/R2 and validated registry metadata.

registry/indexes/capabilities.yaml

@@ -1,4 +1,23 @@
 version: 1
-updated: '2026-06-16'
+updated: '2026-06-17'
 domain: helix_forge
-capabilities: []
+capabilities:
+- id: capability.security.ssh-certificate-issuance
+  name: SSH Certificate Issuance
+  summary: Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors
+    through a stable cert_command CLI interface.
+  vector: D4 / A3 / C3 / R2
+  domain: helix_forge
+  status: draft
+  owner: ops-warden
+  path: registry/capabilities/capability.security.ssh-certificate-issuance.md
+  tags:
+  - ssh
+  - certificate
+  - ca
+  - ops-warden
+  - openbao
+  - security
+  consumption_modes:
+  - CLI
+  - cert_command subprocess