Summary

• Removes the self-signed X.509 production-path expect sites that became new no-panic debt after the SRP split.
• Keeps normal valid-input generation behavior intact while making the non-fallible self-signed path avoid panicking on invalid DNS SAN input.
• Refreshes the no-panic baseline after the removed X.509 expect sites disappeared.

Files added/changed

• crates/uselesskey-x509/src/cert.rs
• crates/uselesskey-x509/src/cert/material.rs
• crates/uselesskey-x509/src/cert/params.rs
• policy/no-panic-baseline.toml

Validation

• cargo xtask fmt
• cargo test -p uselesskey-x509 invalid_dns_san_does_not_block_self_signed_generation --all-features
• cargo test -p uselesskey-x509 --all-features
• cargo clippy -p uselesskey-x509 --all-targets --all-features -- -D warnings
• cargo xtask check-no-panic-family
• git diff --check

Non-goals

• No public API redesign.
• No new X.509 fixture profile or claim.
• No baseline reset.
• No TLS/mTLS behavior expansion.

What this enables next

• Restores the no-panic Stage A.5 posture after the X.509 SRP refactor, so the adoption-confidence lane can close with clean policy evidence instead of a known new-debt exception.