dev/scripts/bootstrap_certs.py generates CA, wildcard cert, distributes to Docker certs.d, and regenerates CoreDNS hosts. Fully tested with tmpdir isolation — CA generation, signing, SAN verification, chain validation, file permissions, skip/force semantics, and distribution.