Expand description
Leaf verification within a cluster’s DNS domain.
Ported from internal/pki/domain_test.go. domain.go doesn’t exist in
the Go codebase either — this file holds only tests, exercising public
API from ca.rs, constraints.rs, and svc.rs.