Opt-in auto-import of the host OS trust store into the extra-CA set (rustls-native-certs)

[Lupus]

What

Follow-up to #283, which ships the explicit host-only <data>/trust/extra/ directory only. If demand appears: an opt-in setting that additionally imports the host OS trust store (rustls-native-certs) into the same extra-CA set — both the guest bundle and izbad's upstream verifier — through the existing single loader so the two consumers can never disagree.

Why

Corporate machines often have the corporate root installed in the OS store already; auto-import would remove the copy step. Deliberately NOT default and NOT part of #283: the explicit directory is deterministic, reviewable, cross-platform, and never widens trust by surprise (the PM recommendation on #283).

In Scope

• A host-only setting (e.g. <data>/trust/settings.json import_os_store: true, default false).
• When enabled, OS roots are appended after the explicit files in the same ExtraCaFile list (same validation, same private-key refusal, same re-serialization to the guest).
• izba daemon status shows the count of OS-imported roots separately.

Out of Scope

• Per-sandbox CA sets; mTLS / client certs.

Acceptance Criteria

• Default off; nothing changes for existing users.
• With the setting on, a CA present only in the OS store verifies from the guest (enforce OFF) and at izbad (enforce ON) — unit-tested via the loader, e2e reusing Honor host-installed custom CA bundles inside the sandbox (guest trust store + izbad upstream verifier) #283's custom_ca harness.
• Status and README document the setting and the reload semantics.