Fix ACME cert not showing for user-channel profiles

[sharon-fdm]

Related issue: Resolves #51281

Checklist for submitter

• Added/updated automated tests

What

ACME certificates deployed via user-scoped profiles on macOS are not showing on the host details page.

How it was reproduced

Integration test (TestACMECertNotShowingForUserChannelProfile) against a real Fleet server + MySQL:

1. Enroll a macOS device, set up user-channel enrollment
2. Upload a user-scoped ACME profile (PayloadScope=User)
3. Trigger profile reconciliation; verify install command goes to user enrollment
4. ACK InstallProfile on the user channel
5. Before fix: CertificateList is queued to the device channel (host UUID). The device channel only sees system-keychain certs, but user-scoped ACME certs land in the user's login keychain. Result: cert is invisible to Fleet.
6. After fix: CertificateList is queued to the user channel (user enrollment ID). The user channel sees login-keychain certs. Result: cert shows up in the host certificates API.

Technical description

Root cause: maybeQueueCertificateListForACMEProfile always sends CertificateList to hostUUID (device channel), regardless of the profile's scope. On macOS, user-scoped profiles install ACME certs into the user's login keychain, which is only visible to the user-channel CertificateList.

Fix (4 small changes):

1. server/fleet/mdm.go: Add Scope field to ProfileACMECommandResult so the caller knows whether the profile is user-scoped or system-scoped.

2. server/datastore/mysql/mdm.go: Select hmap.scope in ProfileHasACMEPayloadForCommand query.

3. server/service/apple_mdm.go: In maybeQueueCertificateListForACMEProfile, when Scope == User, look up the user enrollment ID via GetNanoMDMUserEnrollment and send CertificateList to that enrollment instead of the device UUID.

4. pkg/mdm/mdmtest/apple.go: Add SendRawResponse helper to the test MDM client so integration tests can send command responses with arbitrary plist data (needed to simulate CertificateList responses with certificate payloads).

Testing

• Integration test exercises the full flow: enroll device, user channel, user-scoped ACME profile, reconcile, ACK on user channel, verify CertificateList goes to user enrollment, respond with cert data, verify cert shows in API.
• Run: COMPOSE_FILE=docker-compose.yml MYSQL_TEST=1 MYSQL_PORT=3307 REDIS_TEST=1 go test -v -run 'TestIntegrationsMDM/TestACMECertNotShowingForUserChannelProfile' -timeout 600s ./server/service/

[codecov]

Codecov Report

❌ Patch coverage is 61.53846% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.77%. Comparing base (0597a85) to head (5cec377).
⚠️ Report is 74 commits behind head on main.

Files with missing lines	Patch %	Lines
server/service/apple_mdm.go	44.44%	2 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #51297      +/-   ##
==========================================
+ Coverage   68.65%   68.77%   +0.11%     
==========================================
  Files        3995     4001       +6     
  Lines      257608   258473     +865     
  Branches    13806    13806              
==========================================
+ Hits       176864   177766     +902     
+ Misses      65015    64909     -106     
- Partials    15729    15798      +69     

Flag	Coverage Δ
backend	69.88% <61.53%> (+0.13%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.