pub const DEFAULT_LEAF_VALIDITY_DAYS: i64 = 90;
Default leaf-cert validity (90 days). Workers must re-register before this expires; the control plane should rotate well in advance.