TLS cert capture was the last prober special-case that bypassed ActiveProbeMeta. Moves logic into TlsCertProbe (priority=200, runs after JARM) in probes/tlscert_probe.py; drops _capture_tls_cert, the probe.probe_name=="jarm" name-check, and the direct fetch_leaf_cert import from worker.py.