Each distinct TLS issuer now produces its own CheckState with Subject
set to the issuer label, instead of being folded into a single
concatenated status. Aligns with the SDK v2 contract (see
checker-sdk-go/migrate-v2.md).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
