s3.ceph.unkin.net serves a bare leaf issued by the intermediate, so hosts
carrying only the root cannot verify it.
- Fetch pki_int alongside pki_root and anchor it as UNKIN_INTCA_2024.crt
- Fail the build when a fetch errors or returns a non-certificate
- Bump version to 2026.10.2