Cuvena 43 automatic localhost certificate maintenance

Windows desktop/headless/service setup installs this machine-level feature.
Renewal runs hourly, at startup, and after supported resume events, including
Modern Standby exit. Missed tasks run when available. Failure retries run three
 times at five-minute intervals; the regular hourly trigger continues thereafter.
The machine need not remain awake for renewal, but checks run only when it is awake.

Certificates are created for localhost and renewed 30 days before their one-year
expiry. Existing Cuvena-owned IPv4/IPv6 bindings are validated with normal TLS.
New installs provision loopback-only HTTPS listeners unless external settings
conflict. WinRM starts automatically. Firewall/authentication rules and PowerShell
endpoint access are not widened. Configure execution identities separately.

State/scripts: C:\ProgramData\CuvenaCertificateMaintenance (administrator/SYSTEM
write access). Task: Cuvena Localhost Certificate Renewal, running as SYSTEM.
status.json records the actual outcome. Application event source Cuvena Certificate
Maintenance reports rotation (100) or failure (101). Ownership and a pending
certificate survive interrupted rotation. Failed bindings are rolled back; old
certificates are retained. Never edit ownership to adopt an unrelated certificate.

External/wildcard listener certificates remain their administrator's responsibility.
Linux has no Windows WinRM certificate; external HTTPS/SSH identity maintenance is
separate. Network outages and invalid credentials are not certificate expiry.

Run test-localhost-renewal.ps1 and test-localhost-bootstrap.ps1 for mock regression
checks. A successful test does not replace a real sleep/wake and clean-install test.
