test

Renews certificates for the Kubernetes cluster. Renewals are unconditional and use the local PKI CA by default, falling back to the Kubernetes CSR API or CSR generation if needed. Subcommands allow renewing all or specific certificates (e.g., apiserver, etcd-server).