Persist certificate validation mode and make DNS providers optional for DNS-PERSIST-01 #1285

Parent: #1152

Problem

CertificatePolicyItem requires dnsProviderName, and certificate metadata stores DNS provider and alias information without a validation mode. Automatic renewal cannot restore a DNS-PERSIST-01 policy.

Implementation timing

Reviewed on 2026-10-21. Follow the staged scope in #1152. Defer this implementation until a target CA's staging environment supports the intended draft and usable interoperability examples or test vectors are available. Recheck the latest published specification and the CA's behavior before starting; the current baseline is draft -02.

At review time, the Let's Encrypt production and staging directories did not advertise issuerDomainNames or accountHashPrefix. The rollout announcement alone does not satisfy this gate. This is an Acmebot sequencing decision, not a claim that every scoped feature remains undefined in the draft.

Scope

• Add an explicit DNS-01 versus DNS-PERSIST-01 validation mode to certificate policy and certificate response models.
• Persist the mode in Acmebot's Key Vault certificate metadata and restore it for renewal and retry operations.
• Require a DNS provider only for DNS-01; accept DNS-PERSIST-01 policies without provider configuration.
• Define mode-specific validation for dnsAlias and persistent authorization settings; do not reuse DNS-01 alias semantics implicitly.
• Preserve existing metadata and API compatibility by treating an absent mode as DNS-01. Do not infer or migrate a certificate to DNS-PERSIST-01 merely because directory metadata or a persistent TXT record is present.

Acceptance criteria

• Policy-to-metadata-to-renewal round trips preserve the chosen mode and relevant settings.
• Existing certificates and legacy tags continue to use DNS-01.
• DNS-PERSIST-01 policy validation succeeds without a DNS provider, while DNS-01 still requires one.
• Unknown modes and incompatible settings are rejected with clear errors.
• Tests cover metadata compatibility and mode-specific validation.

Dependencies

#1284 defines the verified authorization settings and limitations to preserve. Coordinate with #1286 and #1287 so a new mode is not exposed as usable before its issuance and interface paths are ready. Retain DNS-01 provider permissions until the complete alternative path is validated.