remove the WNTRMUTE CA (MCP teardown)

Kyle 2026-09-22: the shared CA was only for Metacircular services (system
trust store + the MCR podman registry cert). No host should still depend on
it; anything that does should fail loudly rather than keep trusting it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

certs/wntrmute-ca.pem

@@ -1,19 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC+zCCAlygAwIBAgIUU/AuAKpyYgObdinoeq/EMxMHJBowCgYIKoZIzj0EAwQw
-gZUxCzAJBgNVBAYTAlVTMQkwBwYDVQQIEwAxCTAHBgNVBAcTADEeMBwGA1UEChMV
-TWV0YWNpcmN1bGFyIER5bmFtaWNzMR8wHQYDVQQLExZDcnlwdG9ncmFwaGljIFNl
-cnZpY2VzMS8wLQYDVQQDEyZNZXRhY2lyY3VsYXIgRHluYW1pY3MgUm9vdCBDZXJ0
-aWZpY2F0ZTAeFw0yNjA0MDMxNTU2NTBaFw00NjAzMjkxNjU2NTBaMIGVMQswCQYD
-VQQGEwJVUzEJMAcGA1UECBMAMQkwBwYDVQQHEwAxHjAcBgNVBAoTFU1ldGFjaXJj
-dWxhciBEeW5hbWljczEfMB0GA1UECxMWQ3J5cHRvZ3JhcGhpYyBTZXJ2aWNlczEv
-MC0GA1UEAxMmTWV0YWNpcmN1bGFyIER5bmFtaWNzIFJvb3QgQ2VydGlmaWNhdGUw
-gZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAHsKdE1YpsMJwZ11lmAaATQpj+98T4o
-ufDP8FncMWNJsr9iB14lwf4qeENuXTGIRcqAjKtIOVZEZeWNfDh38S8a3QERxP7V
-Zb56szR/rBtLJudzT0SHmBKNMWxeeOq7/v4bgt/UjK5GbKxplt6olzknF/CyELnL
-8iWHJ9rJqi9hr/C8z6NFMEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB
-Af8CAQIwHQYDVR0OBBYEFEVasWoUPP5XmiyY3sAv8XKCyW08MAoGCCqGSM49BAME
-A4GMADCBiAJCAfZCB7vj6LMogrms10YuhexL38UhqFlbXTFmSQXeNLpeEL3VRdkf
-OvHG8ihZb6xka2BD0q6TfHWz3C00nPVRHLr+AkIBnASX1m8TwlFLyEW8BTnKyNi9
-pbpHQehx1/fF85aI3Zkuw4Hx1x9EdeCAARyuHd6E/FumPTli953PUb2FyISXvm4=
------END CERTIFICATE-----
-

configuration.nix

@@ -151,14 +151,6 @@
   };
   programs.ssh.askPassword =  "ksshaskpass";
 
-  # Trust the WNTRMUTE issuing CA for all Metacircular services.
-  security.pki.certificateFiles = [ ./certs/wntrmute-ca.pem ];
-
-  # Trust the WNTRMUTE CA for podman/skopeo registry connections (MCR).
-  # Podman uses /etc/containers/certs.d/<registry:port>/ca.crt, not the
-  # system CA bundle.
-  environment.etc."containers/certs.d/mcr.svc.mcp.metacircular.net:8443/ca.crt".source = ./certs/wntrmute-ca.pem;
-
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   nix.settings.trusted-users = ["kyle"];