Get the most recent currently-valid certificate for a domain

Returns the latest certificate associated with the given domain name, wrapped in {cert: <detail>}.

Validity semantics (task #772): currently-valid certificates (not_after in the future) are always preferred. Precert semantics (task #776): by default (include_precerts=false) a final leaf always beats ANY precertificate — a precert is only returned when the index holds no final cert for the domain at all. Pass include_precerts=true to let precerts compete on equal terms (newest not_before wins, with the final leaf still preferred over its own precert twin on ties). Only when the index holds NO currently-valid certificate for the domain is an expired one returned — and then the response carries an explicit top-level warning field noting that the returned cert's not_after is in the past (the live cert may simply not have been ingested yet). Never render this endpoint's output in alerting UX without honoring that warning.

raw_pem is always null here (by design): raw certificate bytes live in cold storage and are deliberately excluded from domain-shaped tools to keep LLM context small (task #66). To get the PEM body, take cert.sha256 from this response and call get_certificate with include_raw=true.

Self-healing for cold domains (task #113 / GH #266): unlike the v1 REST route, this tool does NOT raise HTTP 404 when no cert is found — it returns {cert: null, backfill_status: ...} so the LLM can decide whether to retry. When backfill_status == 'in_progress', wait retry_after_seconds seconds and call this tool again. Use eta_basis for the stopping rule: 'live' = measured ETA; 'jobs_coarse' = coarse estimate from job-completion rate; 'unknown' = no projection — terminal_at_latest (ISO-8601 UTC) and seconds_until_terminal give the concrete stop point. in_progress_over_budget (no retry_after_seconds) means the projection exceeds the interactive budget — do NOT poll in a loop. Any other status means the result will not change on retry.