ea83fc58b2
Probe 'prepare' provisions the consumer identity via OpcUaApplicationIdentity.EnsureApplicationCertificateAsync and exports the public DER; runner installs it in the server trusted store before start. Adds Sign (OPCUA_MATRIX_SERVER_SECURITY=sign), untrusted-client / untrusted-server fail-closed controls per secure mode, and OPCUA_MATRIX_ACL=off. Autoaccept stays false everywhere.