cert get: combined file for HAProxy, --local, saved NAME; cert list shows get and last download

- jarl cert get --combined PATH writes the key and full chain in one file
  (mode 600, atomic), kept outside --dir so it can live in HAProxy's crt
  directory; JARL_CERT_COMBINED for the hook. Turning it on, moving it or
  removing it ('') applies from the files on disk and runs the hook.
- jarl cert get --local writes the combined file and runs the hook from
  this host's files, without asking jarld.
- jarl cert saved NAME shows all of one certificate's settings.
- jarl cert list: USES "get" for certificates for other hosts, and a
  PULLED column (last download, "(old)" while a host is behind). Owners
  now see their own downloads (pulled_by), not only administrators.
- jarl cert get without a name refuses per-certificate flags.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -939,6 +939,23 @@ if [ -n "$PEBBLE" ]; then
 	if [ "$(wc -l < $CGD/hook.log)" = 1 ]; then ok "the hook didn't run again"; else bad "hook ran again: $(cat $CGD/hook.log)"; fi
 	run "cert saved" 0 $J cert saved --config-dir $CGD/conf
 	contains "mail  *mail.adbraun.test .*$CGD/mail"
+	run "the owner's cert list: for jarl cert get, downloaded today" 0 $J $CG cert list
+	contains "^mail  *acme  *get  *mail.adbraun.test  *[0-9-]*  *$(date +%Y-%m-%d)  *ok"
+	run "cert get --combined: written from this host's files" 0 $J cert get mail --combined $CGD/haproxy/mail.pem --config-dir $CGD/conf
+	contains "mail .*combined file written, combined $CGD/haproxy/mail.pem"
+	run "the combined file is mode 600" 0 stat -c %a $CGD/haproxy/mail.pem
+	contains "^600$"
+	run "it holds the key" 0 sh -c "openssl pkey -in $CGD/haproxy/mail.pem -pubout | cmp - $CGD/pub.pem"
+	run "and the certificate" 0 sh -c "openssl x509 -in $CGD/haproxy/mail.pem -noout -serial | cmp - \$(openssl x509 -in $CGD/mail/cert.pem -noout -serial > $CGD/serial; echo $CGD/serial)"
+	if [ "$(wc -l < $CGD/hook.log)" = 2 ]; then ok "the hook ran for the combined file"; else bad "hook runs: $(cat $CGD/hook.log)"; fi
+	run "cert saved NAME shows every setting" 0 $J cert saved mail --config-dir $CGD/conf
+	contains "^Combined: *$CGD/haproxy/mail.pem$"
+	contains "^Hook: *echo"
+	run "a combined path inside the files' directory is refused" 1 $J cert get mail --combined $CGD/mail/fullchain.pem --config-dir $CGD/conf
+	contains "would overwrite mail's fullchain.pem"
+	run "cert get --local: the hook runs from this host's files" 0 $J cert get mail --local --config-dir $CGD/conf
+	contains "mail .*this host's files"
+	if [ "$(wc -l < $CGD/hook.log)" = 3 ]; then ok "the hook ran with --local"; else bad "hook runs: $(cat $CGD/hook.log)"; fi
 	run "another user can't take the name (exit 5)" 5 $J --token @$E/hosts2.token cert get mail -d mail.adbraun.test --dir $CGD/x --no-save --config-dir $CGD/conf2
 	contains "taken"
 	run "an ACME token can't get certificates (exit 3)" 3 $J --token @$E/nocert.token cert get x -d x.adbraun.test --dir $CGD/x --no-save --config-dir $CGD/conf2
@@ -951,6 +968,11 @@ if [ -n "$PEBBLE" ]; then
 	contains "mail .*new files"
 	run "the hook ran for the renewal" 0 tail -1 $CGD/hook.log
 	contains "^mail 1 privkey.pem$"
+	run "the combined file has the renewed certificate" 0 sh -c "openssl x509 -in $CGD/haproxy/mail.pem -noout -serial | cmp - \$(openssl x509 -in $CGD/mail/cert.pem -noout -serial > $CGD/serial; echo $CGD/serial)"
+	run "the owner sees the download is current" 0 $J $CG cert list
+	if echo "$OUT" | grep -q "(old)"; then bad "owner's list says (old)"; else ok "no (old) after the download"; fi
+	run "cert get --combined '': the combined file is removed" 0 $J cert get mail --combined '' --config-dir $CGD/conf
+	if [ ! -e $CGD/haproxy/mail.pem ]; then ok "combined file removed"; else bad "combined file still there"; fi
 	run "a name added: obtained again" 0 $J cert get mail -d mail.adbraun.test -d smtp.adbraun.test --config-dir $CGD/conf
 	run "the new certificate has both names" 0 openssl x509 -in $CGD/mail/cert.pem -noout -ext subjectAltName
 	contains "smtp.adbraun.test"