Add a per-issuer certificate counter to issuerAgg and append the count
to each CheckState message and Meta map, so operators can see how many
certificates were observed per issuer at a glance.
The binary doubles as its own healthcheck client via the SDK's
-healthcheck flag, so the probe works in the scratch image
(no shell, no curl, no wget).
