fix: redact live identity/CA specifics from today's SSH-CA command output

Two command-block "evidence" snippets added earlier today pasted real,
live-captured values verbatim: the exact cert file path, the fleet's
actual CA fingerprint, today's real issuance timestamp, and the live
Vault role/principal name. All of it identified real infrastructure
in a way the rest of this repo's established redaction convention
(see docs/firewall-and-network.md's [admin workstation]-style
placeholders) already exists specifically to avoid. Redacted to
bracket placeholders; the structural/format evidence (cert type,
extensions, TTLs) stays genuine.

docs/secrets-and-pki.md

@@ -21,13 +21,13 @@ A managed secrets service (a cloud provider's KMS/Secrets Manager) was a real al
 - **Distribution** — Vault Agent runs on every fleet host, authenticates via AppRole, and renders both certificates and secrets to local disk. No application or service ever talks to Vault directly — this single rule is what makes the rest of the model tractable to reason about.
 - **SSH certificate authority** — a dedicated mount issues short-lived SSH certificates for the fleet's automation identity, instead of that identity holding a single static key with standing, permanent access to every host. A signed certificate is valid for 6 hours (12-hour hard cap), scoped to exactly one principal, and every host trusts the CA's public key directly rather than storing that identity's key at all — the same short-lived-credential philosophy as the PKI mounts above, applied to SSH instead of TLS. A leaked certificate is worthless in hours; a leaked static key used to be useful forever. The one thing that can't use this model at all is Kestra's own SSH-based automation flows — its SSH plugin is a plain client with no certificate support, full stop — see [`docs/orchestration.md`](orchestration.md) for what it uses instead, and why that's a completely separate, unrelated credential rather than a workaround bolted onto this one.
 
-This is the real role definition, not a paraphrase:
+This is the real role definition, not a paraphrase — role and principal names redacted since they identify a live credential, everything else genuine:
 
 ```
-$ vault read ssh-client-signer/roles/sign-ansible
+$ vault read ssh-client-signer/roles/[role name]
 key_type              ca
-allowed_users         ansible
-default_user          ansible
+allowed_users         [automation identity]
+default_user          [automation identity]
 ttl                   6h    (21600s)
 max_ttl               12h   (43200s)
 algorithm_signer      rsa-sha2-512