these all share a session, so mutating *stdin* from the loaded module
would result in the second test failing

previously progress output wasn't being captured and displayed by
failing Dagger tests because for Dagger the progress is emitted at the
pool-level, which was constructed ahead of the progress UI being wired
up.

this simplifies the individual runtime tests since they just need to
pass a single runtime config in, but I'd still prefer to not have a
monolithic progress sink. oh well. maybe that'll improve when we figure
out the progress API in Dagger.

* generate tls certs on every suite run
* remove static tls certs which were also installed into docker
  container
* tests create their own installation with the generated cert instead

note that the cert being out of date isn't detected; you'll need to
docker rm -f the test container still