A route takes its TLS from its tier's certificate #582

Parent

Rewrite the spec and the compiler in place, release 1.0.0, and hand over every Project

What to build

A rendered route takes its TLS from the certificate its tier owns (#405), instead of the hard-coded certResolver: acme the traefik adapter writes today. Live, every route uses cert-manager's wildcard certificate through TLSStore default, so the switch to the tier's own certificate must happen per tier without editing routes. Found while planning the edge handover (#373, 2026-10-23).

Acceptance criteria

• A route's TLS follows its tier's certificate; a plain listener renders no TLS.
• No rendered route names a certificate resolver its tier does not declare.
• The chapter states the rule and its refusals, with short rationale only, and CONTEXT.md carries each new term in the same pull request.
• A worked example shows it; its resolved artifact and its rendered tree are updated and reviewed by hand, never regenerated in CI.
• Each refusal has a refusal example with its diagnostics file.
• The JSON Schemas and their corpus admit the new shape and refuse a malformed one.
• The behaviour-ledger row lands with its test, and npm run verify passes.

Blocked by

• Give a tier its L4 Address and its own certificate