Function single_cert_pem_sha256_fingerprint 

pub fn single_cert_pem_sha256_fingerprint(ca_chain_pem: &str) -> Result<String>

Compute the SHA-256 fingerprint of a PEM chain that must contain exactly one certificate. Enrollment SAS confirmation binds to one daemon CA, not a broader chain, so callers should fail closed on zero or multiple certs.