feat(runtime): secure Nacos registration transport

[XnLemon]

Summary

• make the Nacos API origin scheme explicitly select controlled plaintext or authenticated HTTPS registration
• require a private CA and exact server name for HTTPS, with an optional complete mTLS client pair
• share one fail-closed transport builder across Runtime A and Runtime B
• reject system roots, proxies, redirects, downgrade, unsafe TLS files, and secret-bearing errors
• document the deployment contract for both sample runtimes

Validation

• go test -count=1 ./...
• go test -race ./...
• go vet ./...
• real TLS and mTLS servers cover private-CA success, wrong CA, hostname mismatch, and required client authentication
• bounded/non-regular/invalid material and redacted error tests

Ownership

This remains Samples deployment wiring. Core continues to receive an injected Nacos executor, and the consumer SDK does not gain registry ownership.

Fallback delta

Fallback delta: removed 1, retained 0, added 0, net -1

Removed: implicit system-root trust for HTTPS Provider registration.
Added fallback evidence: none

Closes #9