x5c trust anchors have no production loader

`x5c_trust_anchors` (the SD-JWT VC x5c trust roots) had no production loading path — only test fixtures populated it via `with_x5c_trust_anchors`, so in production the field defaulted to empty and fell back to Mozilla WebPKI roots with no way to add issuer-specific anchors. (Surfaced while scoping the trust-store consolidation.)

`IssuanceEngine` workers cloned the engine before the trust stores (`iaca_trust_store`, `x5c_trust_anchors`) were configured, so they captured the empty defaults and never saw the values set by `with_iaca_trust_store` / `with_x5c_trust_anchors`. Trust roots loaded at startup were invisible to the workers that actually run verification, so every mdoc/x5c verification ran against an empty store — fail-closed, but silently non-functional.

**Scope**
- Add `load_x5c_trust_anchors` in `utils.rs`: seed Mozilla WebPKI roots, append custom certs from configured paths.
- Add the `x5c_trust_anchor_paths` config key.
- Wire into startup trust-loading alongside the IACA loader, sharing the single audit/warn block.
- Change both trust fields to a shared interior-mutable handle (`Arc>>`) so a value set after worker spawn is observed by already-cloned workers.
- Builders update the inner value through the shared handle.
- Verification call sites read through the handle.

**Acceptance Criteria**
- [ ] Trust roots configured via the builders are visible to workers cloned before configuration
- [ ] Existing SD-JWT and mdoc verification tests pass unchanged
- [ ] No change to fail-closed-empty semantics when no roots are configured
- [ ] `x5c_trust_anchor_paths` config key loads custom anchors at startup
- [ ] Mozilla WebPKI roots seeded; custom certs appended
- [ ] Wired into the consolidated startup trust-loading path
- [ ] Unreadable/malformed cert file is a hard startup error

**Priority:** High — silent verification failure; trust roots loaded at startup never reach the verifier.
**Estimated time:** 1 day