Align alpha feature maturity docs and registry; add support-matrix consistency test

[aidankhogg]

Motivation

• Keep the alpha feature-state registry, model metadata, and published support docs in sync so operator-visible maturity statements match actual handler wiring and test coverage.
• Surface and fail CI when a registry entry is documented only in one support doc or when docs contradict the registry.

Description

• Added missing registry entries to netengine/spec/feature_state.py for pki.dnssec_ksk_lifetime_days, pki.dnssec_zsk_lifetime_days, and pki.rotation_policy with experimental/alpha reasons describing rotation-worker usage and partial cutover validation.
• Updated docs/support-matrix.md and docs/spec-alpha-support.md to mark PKI, gateway, cross-world, AND profile, and intermediate-CA fields as experimental and to include specific caveats for DNSSEC cutover, CRL/OCSP publication, dnsmasq/Bird2 dependencies, and external resolver propagation gaps.
• Strengthened documentation validation in tests/test_feature_states.py by adding _support_matrix_rows() and test_registry_entries_are_documented_consistently_in_support_matrices() to ensure every FEATURE_STATE_REGISTRY path appears in both support docs and that each doc reports the same state, and by asserting PKI model fields are present in the registry.

Testing

• Ran the feature-state unit tests with pytest -q tests/test_feature_states.py which passed.
• Ran an expanded test set including pytest -q tests/test_spec_parsing.py tests/test_cli.py tests/test_readiness_cli.py tests/test_pki_features.py tests/test_and_profiles.py::TestFeatureGatePromoted and observed all tests passed (107 passed, 1 warning).
• Confirmed no git diff --check issues before finalizing changes.

---

Codex Task