Release/august

[William Harding (BillmanH)]

Security process update, with some minor updates to docs and deployment process.

NOTE this only applies to the simulation modules edgemqttsim
and demohistorian within the AIO quickstart. Other components are unaffected.

Confirmed as a valid CWE-295 certificate-validation issue in both edgemqttsim
and demohistorian. The MQTT clients previously transmitted the Kubernetes
ServiceAccount token while TLS certificate validation was disabled.

The fix is implemented. Both clients now require the AIO broker CA with
ssl.CERT_REQUIRED, preserve hostname validation, and refuse the K8S-SAT
connection before reading or sending the token when the CA is missing, unreadable,
empty, or invalid. The applications emit an explicit nonsecret log message for
each of these failure cases.

The Kubernetes manifests now mount the AIO trust bundle read-only at
/var/run/certs/ca.crt. Deploy-EdgeModules.ps1 automatically refreshes the
namespace-local ConfigMap from the AIO-managed trust bundle before deploying
either module. The default listener continues to use AIO
cert-manager/trust-manager; custom Key Vault-backed certificates remain managed
through AIO SecretSync.

Validation completed in a development AIO environment. edgemqttsim and
demohistorian were both Running and Ready with zero restarts. Both logged TLS
server verification and successful MQTT connections. The simulator published
telemetry, and the historian subscribed and persisted 2,494 messages across 14
topics with zero session errors. Source scans found no remaining CERT_NONE,
tls_insecure_set(True), or unverified-TLS guidance in the affected modules.