Krikri::PluginHelpers::PemBundle

PemBundle.key_first - reorders the PEM blocks of openssl pkcs12 output so the private key comes first, matching the Ansible module's parse output ([privatekey, certificate, other certificates]). A block counts as the key ONLY from its -----BEGIN <LABEL>----- header line, when the label ends in "PRIVATE KEY" (covers PRIVATE KEY, RSA PRIVATE KEY, EC PRIVATE KEY, ENCRYPTED PRIVATE KEY). The base64 body is never examined: certificate base64 contains the letters "KEY" by chance in a small but real fraction of certificates, which used to make that certificate sort before the actual key. Relative order within keys and within non-keys is preserved explicitly (partition, then concat), not via sort_by stability.