fix(core): preserve configured Git HTTPS CA bundles during vendored auth flows

[robinbraemer]

Intent

preserve configured Git CA bundle while enforcing ssl_verify during vendoring and publish for authenticated HTTPS package cloning

What Changed

• Updated akua-core Git/HTTPS fetch paths to preserve user-configured CA settings while keeping TLS verification behavior explicit, including authenticated vendoring/publish-related flows where previously CA handling could be lost.
• Added and wired dedicated test coverage in crates/akua-core/tests/vendor_https_auth.rs plus transport-level validation (git_transport_backend) to assert CA bundle preservation through HTTPS clone/fetch workflows.
• Updated related CI and documentation surface (.github/workflows/ci.yml, docs/cli.md, docs/sdk.md, site/cli/vendor.html, site/concepts/sdk.html, CHANGELOG.md, docs/security-audit-2026-05-29.md) to reflect and validate the HTTPS CA-preservation behavior.

Risk Assessment

✅ Low: The patch is a focused security hardening plus regression test addition and does not reveal a clearly material correctness or security regression in the changed paths from static inspection.

Testing

Executed three targeted test runs and confirmed all three tests passed; the dedicated HTTPS auth test showed verification is still enforced while using configured CA data (and rejecting ambient header leakage), and the publish round-trip test passed, demonstrating the vendored dependency publish path remains functional under the same TLS-safe resolver stack.

Evidence: HTTPS vendor/auth test transcript

running 1 test
Initialized empty Git repository in /private/var/folders/1y/cjgf53nj31n_dxsspqnjfjvc0000gn/T/.tmpgJf0PP/origin.git/
Initialized empty Git repository in /private/var/folders/1y/cjgf53nj31n_dxsspqnjfjvc0000gn/T/.tmpgJf0PP/work/.git/
[main (root-commit) 0b8f9ed] fixture
 2 files changed, 4 insertions(+)
 create mode 100644 Chart.yaml
 create mode 100644 templates/configmap.yaml
test vendor_add_forces_verification_and_preserves_environment_ca_bundle ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.95s

Evidence: Publish-roundtrip regression test transcript

running 1 test
test publish_then_pull_then_render_offline ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

Evidence: Git transport backend test transcript

running 1 test
test git_fetch_uses_curl_transport_for_tls_configuration ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• cargo test -p akua-core vendor_add_forces_verification_and_preserves_environment_ca_bundle --test vendor_https_auth -- --exact --nocapture
• cargo test -p akua-core publish_then_pull_then_render_offline --test vendor_roundtrip -- --exact --nocapture
• cargo test -p akua-core git_fetch_uses_curl_transport_for_tls_configuration --test git_transport_backend -- --exact --nocapture

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.