fix(warp): give replacing CA env vars the system roots too

[teamchong]

SSL_CERT_FILE, CURL_CA_BUNDLE and REQUESTS_CA_BUNDLE replace the trust store; only NODE_EXTRA_CA_CERTS appends. warp pointed all four at warp-ca.pem (1 cert), so every non-pxpipe HTTPS client inside a warped session lost the public roots and failed verification (gcloud, gws, pip).

Before:

$ REQUESTS_CA_BUNDLE=~/.pxpipe/warp-ca.pem python3 -c "import requests; requests.get('https://oauth2.googleapis.com/token')"
SSLError: CERTIFICATE_VERIFY_FAILED

After:

$ REQUESTS_CA_BUNDLE=~/.pxpipe/warp-ca-bundle.pem python3 -c "import requests; print(requests.get('https://oauth2.googleapis.com/token').status_code)"
404

warp now writes warp-ca-bundle.pem = our CA followed by the OS root bundle (/etc/ssl/cert.pem, ca-certificates.crt, ca-bundle.crt, ca-bundle.pem; an operator's own SSL_CERT_FILE wins; our own bundle is never nested on restart). The three replacing vars get the bundle, NODE_EXTRA_CA_CERTS keeps the CA-only file. If no system bundle exists warp says so at startup instead of silently breaking the child.

Fixes #245

Verify

$ pnpm vitest run tests/warp-ca-bundle.test.ts
 Tests  4 passed (4)

$ pnpm test
 Test Files  75 passed (75)
      Tests  1203 passed (1203)

$ pnpm typecheck
(clean)

$ grep -c 'BEGIN CERTIFICATE' ~/.pxpipe/warp-ca.pem ~/.pxpipe/warp-ca-bundle.pem
warp-ca.pem:1
warp-ca-bundle.pem:129

(macOS curl is not a valid repro: Apple's build trusts the keychain regardless of --cacert. Python requests is, and matches the reporter's gcloud trace.)

• Rebased on current main
• pnpm test and pnpm typecheck pass
• No raw prompts, credentials, session files, or machine identifiers