Function probe_local_ca 

pub fn probe_local_ca(
    ca_cfg: &CaConfig,
    ca_state: &CaState,
    hsm: Option<&Arc<HsmContext>>,
) -> Result<(), String>

One-shot liveness check for a single locally-hosted CA.

Verifies that the CA’s signing key resolves and matches its certificate (or, for an HSM-backed CA, that the PKCS#11 session is live), and that the CA certificate is currently within its validity window.

This is the exact assertion the background probe makes for a local: CA, factored out so callers can run it on demand without a running HealthChecker — notably the admin health endpoint when the HA subsystem is disabled, so that its healthy-CA count reflects a real check rather than an unconditional assumption.

Returns Ok(()) when the CA is live, or Err with a human-readable reason otherwise.