fix: populate cert form email from index.txt emailAddress field on reissue

_parse_index_line now extracts the emailAddress segment from the DN
alongside CN, returning a (cn, expiry, email) triple. CertInfo gains an
email field populated by both load functions.

In _main(), RENEW_SELECTED falls back to cert.email when the metadata
store has no entry for the CN — so certs created outside this tool (or
before the metadata store existed) pre-fill the email field correctly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_pki.py

@@ -54,9 +54,40 @@ def test_parse_4digit_year():
     line = "V\t20251231120000Z\t\t07\tunknown\t/CN=future"
     result = _parse_index_line(line)
     assert result is not None
-    cn, dt = result
+    cn, dt, email = result
     assert cn == "future"
     assert dt.year == 2025
+    assert email == ""
+
+
+def test_parse_email_from_dn():
+    line = "V\t20251231120000Z\t\t07\tunknown\t/CN=alice/emailAddress=alice@example.com"
+    result = _parse_index_line(line)
+    assert result is not None
+    cn, dt, email = result
+    assert cn == "alice"
+    assert email == "alice@example.com"
+
+
+def test_parse_email_absent_returns_empty():
+    line = "V\t20251231120000Z\t\t07\tunknown\t/CN=bob"
+    result = _parse_index_line(line)
+    assert result is not None
+    cn, dt, email = result
+    assert cn == "bob"
+    assert email == ""
+
+
+def test_load_expiring_certs_populates_email(tmp_path):
+    now = datetime.now(tz=timezone.utc)
+    pki = tmp_path / "pki"
+    pki.mkdir()
+    expiry = now + timedelta(days=5)
+    line = f"V\t{expiry.strftime('%y%m%d%H%M%S')}Z\t\t01\tunknown\t/CN=carol/emailAddress=carol@example.com\n"
+    (pki / "index.txt").write_text(line)
+    certs = load_expiring_certs(str(pki), days_past=0, days_ahead=14)
+    assert len(certs) == 1
+    assert certs[0].email == "carol@example.com"
 
 
 def test_load_all_certs_includes_all_valid(tmp_path):