[Subtask] M5: Protocol/cipher constraints and system-truststore mTLS

### Describe the subtask

The completeness milestone — closing the two journeys the core work leaves open.

**Policy constraints.** The configurer contract carries protocol and
cipher-suite restrictions, but the helper doesn't expose them — so a deployment
that must enforce TLS 1.3 today has to hand-implement the interface. Compliance
requirements shouldn't demand custom code.

**System-truststore mTLS.** The helper requires an explicit truststore. A client
talking to a server with a publicly-trusted certificate, while presenting its
own client certificate, has no way to say "default trust, my keystore." That
combination is currently inexpressible through the helper.

## Deliverable

- Protocol and cipher-suite configuration through the helper, not only via the
interface.
- A keystore-only path: client certificate with the platform's default trust.

## Acceptance criteria

- [ ] A deployment can enforce TLS 1.3 (or a cipher list) through the helper
alone
- [ ] A test proves the constraint binds: a handshake outside the permitted
protocols actually fails
- [ ] Client-cert-with-default-trust is expressible and tested against a
trusted server certificate
- [ ] Docs updated for both

Depends on: M3 (and M4 if the helper surface moves).

### Parent issue

#9836

Read parent issue #9836 and the M3/M4 work first, then trace the helper and configurer surfaces they introduce. Add handshake coverage for protocol or cipher rejection and client-certificate use with default trust, and update the related documentation. Done means both acceptance journeys work through the helper alone.

Written by the indexing model from the issue text.