docs: add Connect JumpCloud to Smallstep (Windows)

[joshdrake]

Covers the static SCEP enrollment path for a JumpCloud-managed Windows fleet: API key, platform connection, CA trust, the SCEP Profiles policy, and the JumpCloud Command that writes the agent's registry configuration.

Windows only for now — macOS through JumpCloud is a follow-up.

Two JumpCloud specifics drive the shape of this guide

1. Its SCEP policy only substitutes device variables in Subject Name, so the device identifier rides in the common name (CN=%JumpCloudSystemID%) rather than a SAN. Because the CN is then per-device, the agent's Certificate registry value is written by a Command that reads the local JumpCloud systemKey, rather than being a fixed string.
2. The policy identifies the CA by SHA-1 thumbprint, which the Smallstep console does not display, so the guide shows how to compute it from the intermediate.

Also worth flagging in review: JumpCloud's Key Length field defaults to 1024, and the guide calls out setting it to 2048.

Not yet verified end to end

Written from the JumpCloud policy form and our existing Windows agent docs, but not yet run against a live device. The CA ThumbPrint choice (intermediate, matching what the Intune guide uses as the SCEP profile's "Root Certificate") is the step most worth confirming during the first enrollment.

Part of the JumpCloud integration: smallstep/protobufs#757.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QzGoVrhPaRiNm7ZJuY4yLM

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}