WAF Domain Certificate Status Check

Answers one precise question: for every domain onboarded to WAF in this region, which certificate is bound, when does it expire, and which certificates need renewal now. Read-only inventory and expiry classification; never renews, re-uploads, or re-binds anything. Covers WAF 3.0 (waf-openapi 2021-10-01) and WAF 2.0 (waf-openapi 2019-09-10), CNAME-access domains.

❗ Hard Constraints (highest priority in this document)

Interaction stance — confirm first, query second. Asking the customer for a required input that is missing or ambiguous, and then waiting for the answer, is correct behaviour in this skill — never a failure to act. Guessing an input, or querying around the gap, is the failure.