fix(native): trust system certificate roots in vm0 runner builds

[e7h4n]

Summary

• switch the Rust HTTP and WebSocket TLS clients from bundled WebPKI roots to native system roots
• prepare the immutable fork release v0.33.0-vm0.1
• keep npm publishing disabled outside vercel-labs/agent-browser while allowing the fork to create a GitHub Release

User impact

The vm0 runner image installs its private MITM CA into the Ubuntu system trust store. This build allows agent-browser connect to trust that CA when opening Browser Use CDP WebSockets, resolving the UnknownIssuer failure without disabling TLS verification.

Verification

• cargo fmt --manifest-path cli/Cargo.toml -- --check
• cargo clippy --manifest-path cli/Cargo.toml -- -D warnings
• CARGO_BUILD_JOBS=1 cargo test --manifest-path cli/Cargo.toml (1,030 passed, 96 ignored)
• node scripts/check-version-sync.js
• dependency tree confirms both reqwest and tokio-tungstenite use rustls-native-certs, with no webpki-roots package

The local CI-profile test build was also attempted, but its LTO link was killed by the local container memory limit. The equivalent non-LTO test suite passed, and GitHub CI will run the repository CI profile.