fix(namecheap): extract leaf + chain by scanning PEM armor

[albedosehen]

What

get_info's cert_pem and chain_pem extractors were looking at the wrong XML locations. Namecheap returns:

<Certificates CertificateReturned="true" ReturnType="INDIVIDUAL">
  <Certificate><![CDATA[LEAF_PEM]]></Certificate>
  <CaCertificates>
    <Certificate Type="INTERMEDIATE">
      <Certificate><![CDATA[INT_PEM]]></Certificate>
    </Certificate>
    ...
  </CaCertificates>
</Certificates>

rota was calling first_text("CertificateReturned") and first_text("CACertificate") — CertificateReturned is an ATTRIBUTE on <Certificates> (not an element with text) and CACertificate doesn't exist (the element is <CaCertificates> with nested <Certificate>s). Result: cert_pem + chain_pem both empty, is_issued() always false, polling hangs at await_issuance even when Sectigo has issued the cert and status is active.

Found this by manually extracting the oneiric.dev cert via curl + Python while debugging PR #40's polling behavior. The cert was right there in the response that rota was discarding as 'empty'.

Fix

New ApiResponse::pem_blocks(label) scans the raw response for -----BEGIN <label>-----...-----END <label>----- armor and returns each block in document order. Cuts through the nested-element wrapping by ignoring the XML structure entirely for cert payloads.

get_info now calls pem_blocks("CERTIFICATE"); first block is the leaf, rest are the chain (joined with newlines). The CSR present in the same response is skipped automatically because its label is "CERTIFICATE REQUEST" — BEGIN CERTIFICATE----- (with trailing dashes) doesn't substring-match BEGIN CERTIFICATE REQUEST-----.

Cumulative

This is bug #6 in the rota+Namecheap end-to-end renewal pipeline. Prior PRs in this series:

• feat(namecheap): support Sectigo CNAMECSRHASH DCV method #36 (reverted in fix(namecheap): unwrap CDATA in DCV response, drop dead CSR-hash compute #37): wrong-direction local-compute CNAMECSRHASH
• fix(namecheap): unwrap CDATA in DCV response, drop dead CSR-hash compute #37: CDATA unwrap in xml.rs first_text
• feat(dcv): add DnsCname challenge variant for Sectigo CSR-hash flow #38: DnsCname variant on DcvChallenge
• fix(namecheap): lowercase HostName for setHosts API compat #39: lowercase HostName for setHosts
• fix(namecheap): follow ReplacedBy chain + parse SSLGetInfoResult Status #40: ReplacedBy chain follow + Status XML path
• fix(namecheap): extract leaf + chain by scanning PEM armor #41: this — leaf+chain extraction via PEM armor scan

Verified

• cargo fmt --all --check clean
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo test --workspace --locked 111 daemon tests pass (+3 new)