Issue and renew certificates through DNS-PERSIST-01 without DNS writes #1286

Parent: #1152

Problem

CertificateIssuanceOrchestrator always calls DNS-01 precondition and authorization activities, waits for provider propagation, and deletes challenge records in cleanup. This prevents issuance without DNS provider access.

Implementation timing

Reviewed on 2026-10-21. Follow the staged scope in #1152. Defer this implementation until a target CA's staging environment supports the intended draft and usable interoperability examples or test vectors are available. Recheck the latest published specification and the CA's behavior before starting; the current baseline is draft -02.

At review time, the Let's Encrypt production and staging directories did not advertise issuerDomainNames or accountHashPrefix. The rollout announcement alone does not satisfy this gate. This is an Acmebot sequencing decision, not a claim that every scoped feature remains undefined in the draft.

Scope

• Branch issuance by the saved certificate validation mode.
• Add DNS-PERSIST-01 authorization activities that select the offered challenge and verify existing records in read-only mode.
• Respond to pending challenges and retain normal order polling, finalization, Key Vault import, ARI behavior, and completion/failure handling.
• Handle already-valid authorizations and ready orders, including CA just-in-time validation.
• Bypass DNS zone discovery, provider APIs, provider propagation delays, and DNS cleanup for DNS-PERSIST-01, including failure and retry paths.
• Fail clearly for unavailable challenges or invalid authorization; never silently fall back to DNS-01 and perform DNS writes. Valid directory metadata is not proof that an order will offer this challenge; validate the offered challenge using the protocol checks from Add DNS-PERSIST-01 protocol models and CA capability validation #1282.

Acceptance criteria

• New issuance, manual renewal, and scheduled renewal work with no DNS provider configured or DNS write permissions granted.
• No persistent TXT records are created, changed, or deleted on success, failure, retry, or cleanup.
• Pending and already-valid authorization paths are tested, including a valid authorization returned without an interactive challenge. Distinguish the challenge acknowledgement payload ({}) from the empty POST-as-GET payload required by Generate DNS-PERSIST-01 records for operator-managed pre-provisioning #1283's account proof.
• Existing DNS-01 behavior remains intact.

Dependencies

#1282 (completed), #1284, #1285. Complete the staging interoperability gate before implementing the issuance branch.