feat(build): add system CA root mode

[maxamillion]

Summary

Add feature-controlled TLS root selection so upstream builds keep bundled Mozilla roots while Linux distro builds can use system/native trust stores only.

Related Issue

N/A

Changes

• Add mutually exclusive bundled-ca-roots and system-ca-roots Cargo features.
• Wire root selection through rustls clients and TLS-dependent dependencies.
• Gate supervisor upstream root-store construction on the selected CA source.
• Patch z3-sys locally to avoid pulling webpki-roots in system-root builds.
• Document the build modes in architecture/build.md.

Testing

• mise run pre-commit passes
• cargo check --workspace --all-targets passes
• cargo check --workspace --all-targets --no-default-features --features system-ca-roots passes
• cargo test --workspace passes
• cargo test --workspace --no-default-features --features system-ca-roots passes
• cargo tree -i webpki-roots --no-default-features --features system-ca-roots shows no package
• cargo tree -i webpki-root-certs --no-default-features --features system-ca-roots shows no package
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.