[jorgemoralespou]

Summary

Splits two self-contained commits by @GrahamDumpleton out of #1232 so they
can land now, while the other two commits there (the CA delivery fix for the
CLI and operator, 615bf14, and the start-script tls.crt fallback,
abbbb90) are reworked. Both are cherry-picked unchanged: same patch IDs,
original author kept.

fix(session-manager): mount the whole regenerated /etc/pki into workshop
sessions (from 9aae3fc)

On Fedora 44, mounting only the regenerated /etc/pki/ca-trust leaves
OpenSSL's default CApath (/etc/pki/tls/certs) as the image's stale copy,
and the /etc/pki/tls/cert.pem CAfile symlink no longer exists. Tools that
read a bundle file (curl, git, Go) trust the ingress CA; anything on
OpenSSL's default verify paths, Fedora's system Python among them, does not.

 ca-trust-store-initialization (setup-certificates)
   update-ca-trust
+  ln -sf /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /etc/pki/tls/cert.pem
-  copy /etc/pki/ca-trust -> workshop-ca-trust volume
+  copy /etc/pki          -> workshop-ca-trust volume   # ca-trust, tls, java, rpm-gpg (4 MB)
 workshop container
-  workshop-ca-trust -> /etc/pki/ca-trust (readOnly)
+  workshop-ca-trust -> /etc/pki          (read-write, copied files root-owned)
 downloads init container
-  workshop-ca-trust -> /etc/pki/ca-trust (readOnly)
+  workshop-ca-trust -> /etc/pki          (readOnly)

The init container only runs when session-manager has an ingress CA Secret
(INGRESS_CA_SECRET), so this takes effect where that is already set, for
example Inline mode with caCertificateSecretRef. The Managed-mode custom
CA path only reaches it once the reworked CA delivery fix from #1232 lands.

build(make): have prune-builds remove every untracked build artifact
(from c935f87)

 prune-builds
+  rm -rf workshop-images/base-environment/client-programs
+  rm -rf {lookup-service,secrets-manager,session-manager,tunnel-manager}/venv
+  make -C installer/operator clean-local-charts   # new target, driven by LOCAL_SUBCHARTS

clean-local-charts removes only the packaged runtime subchart tarballs;
the upstream vendored tarballs recorded in SHA256SUMS and scratch/ are
untouched. The target is documented in
developer-docs/build-instructions.md.

Evidence

• Before: in a workshop session on a kind cluster with a self-signed
  CA, Python ssl and requests against the training portal URL fail
  verification while curl in the same terminal succeeds.
  After: Python's default context verifies with the CAfile and with the
  CApath alone; requests, curl, git, helm and kubectl all verify. (Graham's
  verification in Deliver the custom ingress CA to platform components and workshop sessions #1232.)
• For this split: both commits apply cleanly to develop (9526449) with
  patch IDs identical to the originals; workshopsession.py compiles,
  setup-certificates passes bash -n, and make -n prune-builds expands
  clean-local-charts to the five LOCAL_SUBCHARTS tarballs only.

Merge Danger

Door: two-way

Both commits revert cleanly. Nothing persistent changes: the trust store
volume is rebuilt for every session.

Blast Radius: workshop-sessions

Every workshop session with an ingress CA now gets all of /etc/pki from
the init container rather than from its own image, and the workshop
container's mount is no longer read-only. The init container runs the base
environment image, not the workshop's image, so a custom workshop image that
adds files under /etc/pki outside ca-trust (for example a repository
signing key in /etc/pki/rpm-gpg referenced by a .repo file) no longer
sees them when an ingress CA is configured. Before, only ca-trust was
replaced this way. prune-builds only affects local builds.

9aae3fc also needs a backport to support/3.8.x, which moved to Fedora 44
as well; as noted in #1232, only this commit applies there and it will need
a release-notes entry on that line. No release-notes entry here, as the
defect has not shipped in a tagged 4.0 release.