#503 Bundled Deno does not honor the OS/system CA trust store

Description

swamp's bundled Deno runtime validates TLS against its own built-in roots and does not consult the operating-system trust store. In environments that terminate/inspect TLS at a middlebox, or where endpoints present a certificate chaining to a privately-operated root CA installed in the OS trust store, every TLS call (registry + model HTTP APIs) fails with invalid peer certificate: UnknownIssuer. SSL_CERT_FILE is not honored. Working workarounds: DENO_TLS_CA_STORE=system, or DENO_CERT=<ca-bundle>.

Steps to reproduce

1. Install a private/intermediate root CA into the OS trust store (e.g. a corporate TLS-inspection proxy).
2. Configure any model against an HTTPS endpoint whose certificate chains to that CA.
3. Run any method (or any registry call).
4. Observe invalid peer certificate: UnknownIssuer.
5. Re-run with DENO_TLS_CA_STORE=system set — it succeeds.

Environment

swamp 20260528.220437.0; Linux.

Proposed fix

Consult the system trust store by default (or merge system roots), and/or honor SSL_CERT_FILE; at minimum document the DENO_TLS_CA_STORE/DENO_CERT requirement for users behind a TLS-inspecting proxy or a private CA.