ENG-8830 fix(network-ops): make certipy stdin confirmation uniform and hang-safe

[thomasqbrady]

Summary

The certipy_* tools were inconsistent about answering certipy's interactive prompts. certipy_auth / certipy_cert / certipy_req (and the high-level certipy_request_certificate / certipy_certificate_auth helpers) piped "y" to stdin; certipy_account / certipy_ca / certipy_find / certipy_template passed input=None.

input=None leaves the child's stdin inherited, so when certipy prompts (e.g. "overwrite the saved PFX/ccache?") the tool blocks until the 20s command timeout and surfaces as a timeout failure rather than doing anything useful.

This makes every certipy_* tool default to the same confirmation through one documented _CONFIRM_INPUT constant, so stdin is always written and closed and no tool can hang on a prompt.

Why this shape

• Kept the family-wide input: str | None parameter rather than switching to a confirm: bool, so certipy stays uniform with its siblings (impacket, bloodyad, coercion, krbrelayx), which all take input and guard the same prompt-hang this way.
• An empty string falls back to the confirm default on purpose: execute() only writes-and-closes stdin for a truthy input, so forwarding "" would reopen the hang. Callers decline by passing an explicit answer like "n"; the docstrings say so.
• The relay action is exempt — it's a streaming listener that never reads stdin.

Changes

• tools/certipy.py: single _CONFIRM_INPUT default applied at every non-relay execute() call; removed the two hardcoded input="y"; uniform signatures; docstrings describe the default and how to override.
• capability.yaml: 2.1.10 → 2.1.11 (behavior change to the public tool surface).
• tests/test_tool_fixes.py: regression tests for the uniform default, explicit/empty overrides, and the relay exemption.

Testing

• pytest tests/test_tool_fixes.py — 84 passed.
• pre-commit (ruff, ruff-format, gitleaks) clean; dreadnode capability validate passes.
• Verified out-of-band against a real prompting subprocess: with an inherited blocking stdin, input=None hangs to the timeout while the new "y" default returns immediately.

[mkultraWasHere]

nice