fix(#3363): build the test's client without a system trust store

The new regression test constructed `reqwest::Client::new()`, which
panics in the nix build sandbox: with no system CA store,
`ClientBuilder::build()` reaches `rustls_platform_verifier::Verifier::new()`
and fails, and `new()` is `build().expect(..)`. The test passed locally
because a devshell has `/etc/ssl/certs`, and failed in CI.

Disabling certificate verification takes the branch that installs a
no-op verifier and never consults the platform store, so the client
builds anywhere. That is sound in this test and nowhere else: nothing is
sent, the request is built and its bytes are inspected. The helper says
so at the point someone would otherwise object to it.

Found by reading reqwest's `ClientBuilder::build()` rather than trying
builder flags: the first repro attempt — pointing `SSL_CERT_FILE` and
`SSL_CERT_DIR` at nothing — did not reproduce, so any fix verified
against it would have been verified against nothing.

swarm-queue-client/src/lib.rs

@@ -579,9 +579,29 @@ mod tests {
     /// This asserts the *shape of the request* rather than a server's reply,
     /// which is the whole point: it fails on the old code with no identity
     /// provider, no deployment and no network.
+    /// A client for inspecting a request, never for sending one.
+    ///
+    /// 🩸 `reqwest::Client::new()` **panics in the nix build sandbox**, which
+    /// has no system CA store: `ClientBuilder::build()` reaches
+    /// `rustls_platform_verifier::Verifier::new()` and fails with "No CA
+    /// certificates were loaded from the system", and `new()` is
+    /// `build().expect(..)`. The test passed locally — a devshell has
+    /// `/etc/ssl/certs` — and failed in CI.
+    ///
+    /// Turning verification off takes the `!certs_verification` branch, which
+    /// installs a no-op verifier and never consults the platform store, so
+    /// this builds anywhere. It is sound *here specifically* because nothing
+    /// is ever sent: the request is built and its bytes inspected.
+    fn offline_client() -> reqwest::Client {
+        reqwest::Client::builder()
+            .danger_accept_invalid_certs(true)
+            .build()
+            .expect("a client that verifies nothing needs no system trust store")
+    }
+
     #[test]
     fn the_token_request_authenticates_with_http_basic() {
-        let req = token_request(&reqwest::Client::new(), &token_cfg(), "s3cret")
+        let req = token_request(&offline_client(), &token_cfg(), "s3cret")
             .build()
             .expect("the token request must build");