fix(tls): ensure jailed processes trust httpjail CA under sudo (prefer SUDO_USER path; copy cert if needed)

[blink-so]

Summary\n- Prefer SUDO_USER's config path for CA when httpjail is invoked via sudo and the jailed command runs as the invoking user\n- Correct SUDO_USER CA path computation (Linux: /home//.config/httpjail/ca-cert.pem; macOS: /Users//Library/Application Support/httpjail/ca-cert.pem)\n- If only /root CA exists, copy it to the invoking user's config so the non-root process can read it\n- Keep existing env var injection (SSL_CERT_FILE, SSL_CERT_DIR, CURL_CA_BUNDLE, GIT_SSL_CAINFO, REQUESTS_CA_BUNDLE, NODE_EXTRA_CA_CERTS)\n\nAdditional tests\n- Adds tests/weak_gh_integration.rs: verifies gh api /zen succeeds in weak mode on non-macOS and does not hit x509 unknown authority (skips if gh not installed)\n\nWhy\nWhen running under sudo on Linux, the CA is generated under /root/.config/httpjail by default. httpjail then drops privileges (setpriv) to the invoking user before executing the target process. The target process cannot traverse /root, so SSL_CERT_FILE=/root/.config/httpjail/ca-cert.pem is unreadable. Go-based tools like gh then fail TLS verification against the intercepted cert with:\n\nPost https://api.github.com/graphql: tls: failed to verify certificate: x509: certificate signed by unknown authority\n\nmacOS note\nGo on macOS uses the platform verifier (Security.framework), which ignores SSL_CERT_FILE/SSL_CERT_DIR; weak mode interception will still fail for Go clients there. A follow-up change will add a pass-through CONNECT mode on macOS (no TLS MITM) so host-level allow/deny still works without modifying system trust.\n\nManual validation\n- sudo httpjail --js "true" -- gh auth status\n- sudo httpjail --js "true" -- gh pr status\n- sudo httpjail --js "true" -- gh pr create --title test --body test (reaches GraphQL successfully)\n\nIf the CA only exists under /root, the first run will copy it to the invoking user's config and subsequent runs use that path.

[ammario]

Not sure this fixes it. I ran into this error on macOS with the weak jail without sudo.