test coverage improvements; mTLS enforcement; agent broke :(

.env.example

@@ -10,6 +10,10 @@ KEYWARDEN_SHELL_REMOTE_COMMAND=/bin/bash
 KEYWARDEN_SHELL_DEBUG=0
 KEYWARDEN_SHELL_PRESERVE_TMP=0
 KEYWARDEN_SHELL_DIAG_TIMEOUT_SECONDS=10
+# Allowed values: accept-new (default), yes.
+KEYWARDEN_SHELL_STRICT_HOST_KEY_CHECKING=accept-new
+# Directory for CA private key files (stored as file:// refs in DB fields).
+KEYWARDEN_CA_KEY_DIR=/var/lib/keywarden/ca-keys
 # Optional legacy global fallback token for agents.
 # Preferred model is per-agent token issued during /agent/enroll.
 # KEYWARDEN_AGENT_API_TOKEN=