Machine ID: Bound Keypair Joining

[timothyb89]

RFD: #52546

Milestone 1

For the first milestone, we'll opt to focus exclusively on getting keypair joining working with static keys. The very first changeset will only support "unlimited" rejoining without join counter checks, but the final milestone will include joining constraint enforcement. Similarly, we'll include join state document verification by the end of the milestone but will initially merge no-op verification.

Milestone 2

This milestone intends to reach MVP for most users. It includes bind-on-join flows to match token joining UX, more specific lock targets, and keypair rotation flows.

• Keypair bind-on-join
• Keypair rotation
• Bot instance locking
• Alerting UX

Milestone 3

This milestone focuses on additive and UX-focused features, particularly additional keystore backends and other UX improvements.

• Hardware Key Storage
• Bot Joining URIs
• tctl token management UX
• Prometheus metrics