All data-mesher-node-identity certs were signed on 2026-07-22 with the
default 90-day validity and expired on 2026-10-20, taking the whole mesh
down ("identity certificate not signed by network certificate authority"
is actually an expiry failure). Nothing rotates them automatically.
Requires `clan vars generate --generator data-mesher-node-identity
--regenerate` and a redeploy to take effect.