v0.2.2

The agent will not renew a certificate before it was issued

ghcr.io/certpilot/agent:0.2.2     linux/amd64, linux/arm64
go install github.com/certpilot/certpilot-agent/cmd@v0.2.2

A renew_after from before the certificate was issued is no longer obeyed (#5).

• The problem: a core before v0.2.0 computed renew_after with no floor. A certificate shorter than the renewal lead time, such as a 6-day ACME certificate under the default 30 days, got a renew_after that had already passed. The agent obeyed it and ordered a replacement on every five-minute cycle, 288 orders a day for one name (certpilot/certpilot#109).
• What the agent does now: when renew_after falls before the certificate was issued, the agent renews when a third of the certificate's life remains. That is the rule core v0.2.0 itself applies, so a host talking to an older core behaves as if the core were fixed. It logs a warning on every cycle until the renewal is due, because the warning means the core needs upgrading.
• Unchanged: every other renew_after is obeyed exactly. The core decides when to renew.

Verified end to end: an agent built from this change was run against a core with the old arithmetic. That core said renew after 24 days before issue. The agent warned, scheduled the renewal for day 4, and a second cycle left the certificate alone.

Nothing else changed for a host.

Known issues: none open against the agent. Core v0.2.0 fixes both core issues the v0.2.1 notes listed, certpilot/certpilot#107 and #109. This release adds the agent's own check against #109.