feat(tls): embed hive CA into agent flakes for self-signed trust

Wire agents to trust the gateway's self-signed leaf at build time. When
the gateway runs self-signed TLS, hive-tls sets HIVE_TLS_CA_PATH in
hive-c0re's service env pointing at the host hive CA cert. The meta flake
renderer reads it and, when present, writes the public CA cert next to
flake.nix as hive-ca.pem and emits security.pki.certificateFiles so every
agent's system trust store includes the hive CA.

Build-time embedding (rather than a runtime bind-mount + bundle service)
keeps trust robust: the CA travels with the flake source, lands in the
standard NixOS trust store, and needs no per-process SSL_CERT_FILE
plumbing. Only the public CA certificate is embedded; the CA private key
never leaves the host. The cert is re-embedded and re-committed on CA
rotation even when the flake is otherwise byte-identical; when self-signed
TLS is off the embedded cert is dropped so the flake stays buildable.

Covers OpenSSL-based tools (git, curl) directly. A follow-up switches the
hive-forge reqwest client to native roots so it picks up the same store.

nix/modules/hive-tls.nix

@@ -153,5 +153,13 @@ in
         fi
       '';
     };
+
+    # Signal the hive-c0re lifecycle that a hive CA exists: it bind-mounts
+    # this file (read-only, the CA cert ONLY — never the key) into each
+    # agent container so agents + their tools can trust the gateway's
+    # self-signed leaf, and the meta flake wires the per-agent trust
+    # bundle. Only the `ca.pem` path is exposed; `ca-key.pem` stays on the
+    # host (an agent that could read it could mint trusted certs).
+    systemd.services.hive-c0re.environment.HIVE_TLS_CA_PATH = "${cfg.stateDir}/ca.pem";
   };
 }