feat(network): define custom CA bundle contract

[luoye520ww]

Problem

Enterprise networks may require a user-selected CA bundle, but the project has no shared validation contract. This PR establishes the safe boundary before runtime wiring.

Scope

Adds a strict shared Custom CA bundle contract with absolute cross-platform path validation, optional SHA-256 fingerprint normalization, bounded path length, and control-character rejection. Disabled settings cannot retain certificate metadata.

Non-goals

No TLS agent wiring, proxy changes, settings UI, or certificate file reads are included; those will be separate PRs.

Safety

The contract intentionally does not expose PEM contents and rejects unknown fields including insecureSkipVerify.

Tests

• npm.cmd exec vitest run src/shared/custom-ca.test.ts (7 passed)
• npm.cmd run typecheck
• npm.cmd --prefix kun run typecheck
• npm.cmd run lint
• npm.cmd run build
• git diff --check

Review

Completed functional, data integrity, security, cross-platform, compatibility, and scope review. No package smoke is claimed because this is a shared contract-only change.

Issue

Part of #885

[luoye520ww]

The failed check is an external Electron download failure (FetchDownloader / etch failed) during the existing extension release gate. The changed contract itself passes the local root/Kun typechecks, lint, build, and targeted tests. I am rerunning the failed job; no unrelated runtime change is being added to this PR.

[luoye520ww]

Superseded by consolidated provider/network safeguards PR #948, which passed Typecheck, Linux, macOS, and Windows packaged checks. Closing this duplicate to keep the review surface focused.