fix(conformance): workload-mTLS certificates may use a private CA, if they prove they are workload-internal

R-TLS-01/docs/08 govern externally reachable TLS and ADR-0006 puts workload mTLS out of scope, but
tls-lifecycle-automated required ACME for every Certificate, which platform/buildkit's internal CA
cannot satisfy. Clause (5b) accepts the tls-scope=workload-mtls annotation only when the
certificate proves it: no Gateway serves it, internal names only, namespaced selfSigned/ca issuer
backed by an exempt CA certificate. Also fixes yamllint comma spacing in the buildkitd mounts.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/buildkit/deployment.yaml

@@ -114,13 +114,13 @@ spec:
             limits:
               memory: 4Gi
           volumeMounts:
-            - { name: certs,   mountPath: /certs, readOnly: true }
-            - { name: config,  mountPath: /etc/buildkit, readOnly: true }
-            - { name: cache,   mountPath: /home/user/.local/share/buildkit }
-            - { name: run,     mountPath: /run/user }
-            - { name: tmpdir,  mountPath: /home/user/.local/tmp }   # the image's TMPDIR
-            - { name: tmp,     mountPath: /tmp }
-            - { name: clicfg,  mountPath: /home/user/.docker }      # buildctl (the probes) writes here
+            - { name: certs, mountPath: /certs, readOnly: true }
+            - { name: config, mountPath: /etc/buildkit, readOnly: true }
+            - { name: cache, mountPath: /home/user/.local/share/buildkit }
+            - { name: run, mountPath: /run/user }
+            - { name: tmpdir, mountPath: /home/user/.local/tmp }   # the image's TMPDIR
+            - { name: tmp, mountPath: /tmp }
+            - { name: clicfg, mountPath: /home/user/.docker }      # buildctl (the probes) writes here
       volumes:
         - name: certs
           secret: