20260914 强制 TOML 配置并完善 TA 刷新与 daemon

docker/examples/validate.toml

@@ -0,0 +1,17 @@
+# Container paths. Omit ta to refresh the TA certificate each run.
+# TAL files themselves are operator-maintained and are never auto-updated.
+config-version = 1
+mode = "validate"
+out = "/output"
+rrdp-state-dir = "/state/repository"
+ccr-out = "/output/result.ccr"
+run-timeout-secs = 1800
+require-complete = true
+ta-refresh-policy = "allow-valid-cache"
+log-level = "info"
+log-format = "text"
+
+[[anchors]]
+id = "anchor"
+tal = "/input/anchor.tal"
+# ta = "/input/anchor.cer" # uncomment to pin a fixed TA certificate