agent: provide minimal install-config for runtime cert generation

The TLS refactor added InstallConfig as a dependency to signer
certificates for configurable PKI support. This broke the
`agent create certificates` command when run without an install-config,
as happens in `set-node-zero.sh` during UI-based agent installations.

Provide a minimal dummy install-config in set-node-zero.sh and the
tls_assets integration test to satisfy the dependency. The signer certs
don't use any cluster-specific data from the config — they only read
the PKI field which defaults to RSA-2048 when absent.

Assisted-by: Claude Code (Opus 4.6)

Author: hasbro17

cmd/openshift-install/testdata/agent/image/assets/tls_assets.txt

@@ -10,3 +10,12 @@ exists $WORK/tls/admin-kubeconfig-signer.key
 exists $WORK/tls/kube-apiserver-lb-signer.key 
 exists $WORK/tls/kube-apiserver-localhost-signer.key
 exists $WORK/tls/kube-apiserver-service-network-signer.key
+
+-- install-config.yaml --
+apiVersion: v1
+baseDomain: localhost
+metadata:
+  name: agent-certs
+platform:
+  none: {}
+pullSecret: '{"auths":{"unused":{"auth":"dW51c2VkCg=="}}}'

data/data/agent/files/usr/local/bin/set-node-zero.sh

@@ -52,7 +52,20 @@ if [ "${IS_NODE_ZERO}" = "true" ]; then
        # shellcheck disable=SC1091
        . /usr/local/bin/release-image.sh
        IMAGE=$(image_for installer)
+       # The installer's cert generation requires an install-config dependency
+       # even though signer certs don't use any cluster-specific data.
+       # Provide a minimal config to satisfy the dependency.
+       cat > /tmp/install-config.yaml <<'ICEOF'
+apiVersion: v1
+baseDomain: localhost
+metadata:
+  name: agent-certs
+platform:
+  none: {}
+pullSecret: '{"auths":{"unused":{"auth":"dW51c2VkCg=="}}}'
+ICEOF
        /usr/bin/podman run --privileged -v /tmp:/assets --rm "${IMAGE}" agent create certificates --dir=/assets
+       rm -f /tmp/install-config.yaml
        cp /tmp/tls/* $AGENT_TLS_DIR
     fi