Build an https.Agent that PINS the device-managed ingest leaf: the leaf is
trusted as the sole CA for the connection, so a self-signed leaf validates
as a trust anchor — while Node's default checkServerIdentity STILL enforces
SAN/hostname matching (we do NOT set rejectUnauthorized:false). Scope one
agent per PUT so the pin cannot leak to unrelated requests. Throws if
pinCertDerB64 is empty (a caller should not pin against nothing).
Build an https.Agent that PINS the device-managed ingest leaf: the leaf is trusted as the sole CA for the connection, so a self-signed leaf validates as a trust anchor — while Node's default
checkServerIdentitySTILL enforces SAN/hostname matching (we do NOT setrejectUnauthorized:false). Scope one agent per PUT so the pin cannot leak to unrelated requests. Throws ifpinCertDerB64is empty (a caller should not pin against nothing).