Function sign_and_write_scope 

pub fn sign_and_write_scope(
    config: &Config,
    persistent_sources: &PersistentSources,
    ca_config: &CaConfig,
) -> Result<SignedScope, String>

Sign one CA scope by label, resolving its source, and write the resulting .ahu to the configured bundle directory. Used by the on-demand admin API.