feat(cli): trust custom host CA roots

[helix-nine]

Summary

• add authenticated start-cli server trust-ca <CERTIFICATE> support for files and stdin
• validate a single PEM X.509 CA certificate, identify it by SHA-256 fingerprint, and update the host trust store transactionally
• serialize trust-store writes, let an accepted transaction finish if its caller disconnects, and reload StartOS's outbound HTTP client immediately
• persist custom roots through the StartOS overlay without changing service-container trust stores
• release the command in start-cli 2.1.0 and update both product changelogs, translations, documentation, and generated manpages

Verification

• make start-core-test
• cargo test -p start-core system::trust_ca::tests --features=test
• cargo test -p start-core fingerprint_tests --features=test
• cargo test -p start-core reloadable_http_client_replaces_future_clones --features=test
• cargo test -p start-core export_manpage_start_cli --features=test
• cargo test -p start-core start_cli --features=test
• cargo check -p start-cli
• cargo check -p start-os
• cargo build -p start-cli --bin start-cli
• cargo build -p start-os --bin startbox
• cargo fmt --all -- --check
• make start-core-format-check
• make start-cli-format-check
• projects/start-docs/build.sh
• VM integration on StartOS 0.4.0: file/stdin installation, malformed and leaf rejection, fingerprint idempotence, immediate TLS trust, reboot persistence, existing-root preservation, and package-container isolation

The first post-rebase manpage-generator run hit corrupted incremental linker artifacts. cargo clean -p start-core removed the stale cache; the same command then passed and regenerated the committed 2.1.0 pages.

cargo clippy -p start-core -p start-cli --all-targets --features=test reaches pre-existing #![deny(warnings)] failures in shared-libs/crates/patch-db/json-patch; it reports no finding in the changed code before stopping.

Closes #3894

[helix-nine]

High-effort review of git diff origin/master...HEAD found and fixed seven groups in e985cf9ae and d4acc5705:

• offload certificate parsing from Tokio workers
• remove clock-dependent trust-anchor validity rejection and accept extensionless X.509 v1 roots only
• combine HTTP-client rebuild and replacement into one atomic reload operation
• publish the persistent overlay certificate only after live refresh and client reload succeed
• restore source roots, refresh non-destructively, and reload the client on rollback
• durably commit atomic file renames and newly created directory chains on Linux
• fold the start-cli contributor guide into its scoped AGENTS.md and repoint inbound links

The fix pass also covered relative paths, direct AtomicFile callers, and custom temporary paths in another directory.

Validation:

• make start-core-test (510 passed, 3 ignored)
• focused trust-CA, reloadable-client, and atomic-file tests
• cargo check -p start-core --features=test
• make start-core-format-check
• make start-cli-format-check
• scoped Prettier check
• git diff --check

A direct aarch64-apple-darwin cross-check could not start because this host has no Apple cross-C compiler (cc rejects -arch); the new directory-sync operation is Linux-gated.