**Purpose:** SSH CA and certificate lifecycle manager — signs short-lived certs for adm/agt/atm actors; provides the cert_command interface consumed by ops-bridge.

**Domain:** custodian
**Repo slug:** ops-warden
**Topic ID:** cee7bedf-2b48-46ef-8601-006474f2ad7a