ref(certificates): Build the Sentry CA trust store at install time

[oioki]

Replace the runtime custom-CA handling for the sentry services with an install-time trust store. install/setup-sentry-trust-store.sh copies the sentry image's own /etc/ssl/certs and adds every certificates/*.crt (appended to the bundle, plus the file and its hash link), and the sentry services mount the result read-only at /etc/ssl/certs. The entrypoint: /etc/sentry/entrypoint.sh override (bash + update-ca-certificates) and the /etc/ssl/certs chown go away, so sentry services run the image's own entrypoint, including on images without a shell.

Behavior changes worth a look:

• After changing files in ./certificates, re-run ./install.sh (previously a restart was enough).
• Only top-level certificates/*.crt are used, like SETUP_CUSTOM_CA_CERTIFICATE; update-ca-certificates also picked up subdirectories.
• The store exists only after ./install.sh; starting the stack without it mounts an empty /etc/ssl/certs.

setup-custom-ca-certificate.sh used to rm -rf certificates/.generated, which would now delete the sentry store; it only wipes the per-service directories it generates.

Overlaps with #4543 (moves the chown into customize_image.py) — whichever lands second drops it.

Part of making self-hosted run on the distroless sentry image by changing only SENTRY_IMAGE.

[github-actions]

Coverage Results 📊

✅ 22 passed | Total: 22 | Pass Rate: 100% | Execution Time: 10m 37s

All tests are passing successfully.

✅ Patch coverage is 100.00% (4 of 4 changed executable lines covered; target 50%).
Project statement coverage is 95.59%.

Changed files with executable lines (1)

File	Patch coverage	Changed executable lines
_integration-test/test_01_basics.py	100.00%	4/4 covered

---

Generated by Coverage Action

[BYK]

My only worry is this being a potentially breaking change for existing users.

[aldy505]

My only worry is this being a potentially breaking change for existing users.

True.