Register a SPIRE workload entry with UNIX socket selector and a DNS SAN and fetch an X.509-SVID

Steps

1. Confirm the SPIRE server is running and the agent is attested: 'spire-server bundle show -format pem' should return the trust bundle
2. Register a workload entry binding a SPIFFE ID to a Unix UID selector: 'spire-server entry create -spiffeID spiffe://example.org/myapp -parentID spiffe://example.org/spire/agent/k8s_sat/default/node1 -selector unix:uid:1000'
3. Add a DNS SAN to the entry so the issued X.509-SVID includes a DNS name for TLS compatibility: 'spire-server entry create -spiffeID spiffe://example.org/myapp -parentID spiffe://example.org/spire/agent/k8s_sat/default/node1 -selector unix:uid:1000 -dns myapp.example.org'
4. From the workload process (running as UID 1000), call the Workload API via the Unix socket: 'spiffe-helper' or use the go-spiffe library 'workloadapi.NewClient(ctx, workloadapi.WithAddr("unix:///run/spire/sockets/agent.sock"))'
5. The SVID bundle returned contains the X.509-SVID certificate, private key, and trust bundle; extract and use for mTLS
6. Watch for SVID rotation by subscribing to the Workload API stream rather than polling; go-spiffe's 'WatchX509Context' handles this automatically