[codex] trust platform TLS roots

[aksOps]

Summary

• default Lane HTTP clients to the platform trust store so internal GitLab instances signed by corporate CAs work without disabling TLS
• share TLS policy across GitLab API, OAuth token exchange, and LLM calls
• document LANE_TLS_ROOTS=webpki and last-resort LANE_TLS_DISABLE_VERIFICATION=true

Root Cause

Lane used ureq with bundled webpki roots, which bypassed corporate CA certificates installed in the OS trust store and produced unknown issuer / invalid peer certificate errors for internal GitLab.

Validation

• cargo test --locked => 294 passed
• cargo fmt --check
• cargo build --release --locked
• cargo clippy --all-targets --all-features --locked => 0 errors, existing warnings only
• cargo check --target x86_64-unknown-linux-musl --locked

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud