One loose end remains from First Run: the browser warning from The Expected Warning (frame 9). Before you retire it, look at the certificate it points at — it is not a placeholder. It was issued by ica-infra, under goca-infra-root, from a real template: the machinery that will issue your customer certificates has already issued this one.
That template, goca-service-tls, ships as an ordinary versioned document you can read: 30-day validity, ECDSA keys, serverAuth, automatic approval, a 10-day renewal window. Edits create version N+1, like any template.
The names in the certificate come from the deployment, not just the document: localhost, the container hostname, the loopback IPs, and anything in GOCA_SERVICE_DNS are always included — they are how goca reaches itself. Template-authored names are unioned with those, never substituted, so a template edit cannot lock the console out of the deployment it was made from.
The only thing wrong with this certificate is that your browser doesn't trust its root yet. That is the next frame.