feat(build): add system CA root mode

[politerealism]

Summary

• Add mutually exclusive bundled-ca-roots / system-ca-roots feature flags to openshell-supervisor-network and openshell-sandbox, allowing Linux distribution builds to use the platform trust store instead of bundled Mozilla roots
• Switch CLI and gateway unconditionally to native CA roots (rustls-tls-native-roots, tls-rustls-ring-native-roots) so RPM-built binaries respect the system trust store without feature flags
• Fix rust:verify:telemetry-off CI task to explicitly re-enable bundled-ca-roots when disabling default features, preventing the new compile_error! guard from firing

Related Issue

Enables downstream RPM packaging (https://gitlab.com/redhat/hummingbird/rpms/-/merge_requests/2503) to build against system CA roots.

Changes

• crates/openshell-supervisor-network/Cargo.toml: Make webpki-roots optional behind bundled-ca-roots (default), add system-ca-roots feature gating rustls-native-certs
• crates/openshell-supervisor-network/src/l7/tls.rs: Add compile-time guards enforcing exactly one CA root mode; refactor build_upstream_client_config to return Result and support both modes
• crates/openshell-sandbox/Cargo.toml: Forward bundled-ca-roots/system-ca-roots features to supervisor-network; set default-features = false on the dependency
• tasks/rust.toml: Add rust:verify:system-ca-roots CI task; fix rust:verify:telemetry-off to pass --features bundled-ca-roots
• Cargo.toml: Add rustls-native-certs to workspace dependencies; switch reqwest, sqlx, kube to native root variants

Testing

• mise run rust:verify:telemetry-off passes (telemetry compiled out, CA root guard satisfied)
• mise run rust:verify:system-ca-roots passes (system-ca-roots compiles, no webpki-roots in dep tree)
• cargo test -p openshell-supervisor-network passes under default features
• Downstream RPM spec (cargo build --release --bin openshell --bin openshell-gateway) builds without feature flags

Checklist

• Conventional commit format
• compile_error! guards enforce mutual exclusion
• No bundled Mozilla roots leak into system-ca-roots builds
• CLI and gateway use native roots unconditionally
• CI telemetry-off verification updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your interest in contributing to OpenShell, @politerealism.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[politerealism]

I have read the DCO document and I hereby sign the DCO.

[politerealism]

recheck

[maxamillion]

/ok to test 00c9b14