Bun's fetch ignores NODE_EXTRA_CA_CERTS, so private-CA gateways failed
with `unknown certificate verification error` on every OpenAI-compatible,
Codex, Ollama, Azure Responses, and Google call. The env var was only
plumbed through resolveFoundryTlsOptions() on the Anthropic Foundry path.
Added a shared wrapper (wrapFetchForExtraCa / withExtraCaFetch) that
merges the resolved CA bundle into Bun's RequestInit.tls.ca and seeds
the system root store alongside it (Bun's tls.ca replaces the default
trust store when set). The wrapper composes with the existing proxy /
request-debug stack in streamDispatch and streamSimple, so every
provider call now picks up the env var. Path-mtime cache invalidation
mirrors the Foundry helper so rotating bundles are picked up live.
Fixes#3731
roboomp
41e9bc861b