Certificate clients for controlplane-agent (mTLS sync)
Create a client, issue a one-time enrollment token, then enroll on the host. Grant policies in Policies.