Stable v2.6.9

• fix(ssl): disabling SSL revokes the site cert-name, not the alias, and is non-fatal
• test(dnsname): cover IDN punycode normalization
• fix(agent): self-heal a missing panel cert so nginx never breaks globally
• feat(idn): punycode IDN names at the TLS/nginx boundary