The first two points from this change are now deployed: tlsserver is issuing 45-day certificates, and the tlsclient profile is allowlisted to accounts which had previously used it.
The switch to issuing using intermediates in our Y hierarchy has been delayed at least one more weeks while we evaluate the impact of our recent re-issuance of the cross-signed CA certificates. We'll provide an updated timeline before making that change.