certificates & ucentral-schema: restore insta operational certs across factory reset (WIFI-15683)

[abhivyas1992]

ucentral-schema: keep operational certs across factory reset and upgrade

The uCentral app factory reset (cmd_factory.uc) and firmware upgrade
(cmd_upgrade.uc) keep_redirector paths preserve the birth certs but not the
operational cert/CA, so the AP loses its operational certificate. Add
operational.pem and operational.ca to both keep lists via feed patches; the
entries are archived only when present (existing fs.stat guard), so this is a
no-op on devices without an operational cert.

Complements the early_boot restore, which recovers the operational cert from
the insta partition when only the birth key is kept.

certificates: restore insta operational certs across factory reset

On udaya,a5-id2 the EST-enrolled operational cert/CA are stored in the
insta1/insta2 A/B partitions, but a factory reset left the AP without them.
Three problems in the early-boot restore path, all fixed here:

• mount_certs and store_certs shared a tar_part_lookup() that both read AND
  flipped the cert_part u-boot env, so the reader selected the opposite
  partition from where store_certs wrote. Make the reader map cert_part to
  the active partition without flipping.
• mount_certs runs from early_boot at S09, before uboot-envtools generates
  /etc/fw_env.config (S95). A factory reset wipes that config, so fw_printenv
  returned empty and the wrong (empty) partition was picked. Generate the
  config first when it is missing.
• early_boot skipped the restore whenever /etc/ucentral/key.pem existed. An
  app factory reset (keep_redirector) preserves the birth key.pem but not the
  operational cert, so mount_certs never ran. Return early only when fully
  provisioned (key.pem AND operational.pem present).

Fixes: WIFI-15683
Signed-off-by: abhishek vyas abhishek.vyas@inventum.net
https://telecominfraproject.atlassian.net/browse/WIFI-15683

[abhivyas1992]

OLD PR 1172 migrated to new PR, so closing OLD PR 1172