[shipmill-romamo]

Spec for #87

• cloudfall domains apply <domain> [--issue-certificate] [--yes] runs domains.yml for one Domain on its proxy server only, with no baseline, firewall or service task; without --yes it shows the plan and exits 0
• --issue-certificate checks on the controller that primaryName and every alias resolve to the proxy server (skipped for proxied edges, as migrate does), then runs the role's HTTP, issuance, TLS sequence
• An unknown domain id exits PRECONDITION (lifecycle_domain_missing) before any SSH, matching deploy for an unknown component
• DeploymentReceipt gains an optional previousConfigurationSha256, the hash of the vhost a run replaced
• cloudfall domains observe <domain> reads the vhost and its hash against the receipt, the certificate's notAfter and certbot.timer state, read-only
• Both commands are served over MCP, and converge_domains gains an optional domain argument

Spec only, no product code.

🤖 Generated with Claude Code

[shipmill-romamo]

@romamo Decision needed: do you approve this spec as written? Merging a spec is its approval (the spec gate), so shipmill holds it for your review instead of merging it on green CI.

1. Approve (recommended once you've read it): merge it yourself, or reply "1" and shipmill merges it on the next tick, then splits it into build issues and starts the build
2. Request changes: reply or review with what to change; shipmill revises the spec in this PR and asks again
3. Refuse: close the PR; the issue reads SPEC_REFUSED and triage decides again (postpone or won't fix)

Reply here with a number or your own answer; shipmill takes this up on the tick after your reply.