refactor(prober): absorb TlsCertProbe into ActiveProbe registry

TLS cert capture was the last prober special-case that bypassed
ActiveProbeMeta. Moves logic into TlsCertProbe (priority=200, runs
after JARM) in probes/tlscert_probe.py; drops _capture_tls_cert,
the probe.probe_name=="jarm" name-check, and the direct
fetch_leaf_cert import from worker.py.

decnet/prober/base.py

@@ -2,8 +2,6 @@
 ActiveProbe ABC and metaclass registry for port-iterating active probes.
 
 Adding a new active probe = one class with three methods.
-IPv6 leak and TLS cert capture are NOT part of this registry (different
-call shapes); they stay as special cases in prober/worker.py.
 """
 
 from __future__ import annotations