@cloudflare/vite-plugin dev: workerd outbound TLS ignores system CA store on NixOS

### What versions & operating system are you using?

System:
OS: Linux 7.1 cpe:/o:nixos:nixos:26.11 26.11 (Zokor)
CPU: (4) x64 Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
Memory: 4.73 GB / 15.54 GB
Shell: 5.3.15 - /run/current-system/sw/bin/bash
Binaries:
Node: 24.18.1 - /run/current-system/sw/bin/node
bun: 1.3.13 - /run/current-system/sw/bin/bun
npmPackages:
@cloudflare/vite-plugin: 1.52.1
wrangler and miniflare are transitive deps, so they don't show in envinfo. Workerd in node_modules/@cloudflare/workerd-linux-64 reports version 1.20260811.1. Also using @cloudflare/vite-plugin 1.52.1 with Vite 8.2.1 and solid-js 2.0.0-rc.0 with the Solid start middleware.

### Please provide a link to a minimal reproduction

Not yet published. Repro setup: any SolidJS/React app using @cloudflare/vite-plugin with viteEnvironment: { name: "ssr" }, a Hyperdrive local connection string, and a route that queries a Postgres database whose TLS cert is chained to a 2026 Let's Encrypt root (leaf -> YR1 -> Root YR -> ISRG Root X1). On NixOS, load the homepage. I can push a minimal reproduction on request.

### Describe the Bug

Running bun run dev on NixOS with the Cloudflare Vite plugin floods stdout with TLS errors on every request that reaches a service connecting out over TLS. Each homepage load fired the error roughly 10 times (the DB client pool maxes at 10 connections):

e = kj/compat/tls.c++:269: failed: TLS peer's certificate is not trusted; reason = unable to get local issuer certificate

Steps:
1. Create an app with @cloudflare/vite-plugin, ssr vite environment, and a service that connects to a remote TLS endpoint with a 2026 Let's Encrypt certificate.
2. bun run dev.
3. Load a page that triggers outbound TLS.

Actual: outbound TLS fails with the error above. The service endpoint is unreachable.

Expected: outbound TLS trusts certs issued by the new Let's Encrypt roots.

The server cert itself is valid. curl trusts the chain, Node's fetch succeeds, and OpenSSL validates leaf -> YR1 -> Root YR -> ISRG Root X1. Only workerd fails, so it is not reading the system trust store. wrangler dev wires workerd to the system store; the Vite plugin's dev path does not, so workerd falls back to its built-in bundle.

Workaround that fixes it:

NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt bun run dev

Workerd and miniflare honor NODE_EXTRA_CA_CERTS. With it set, the errors stop and the DB connection succeeds.

Related: #8158 reports the same error with @astrojs/cloudflare. miniflare#587 passes NODE_EXTRA_CA_CERTS through as trusted certs, workerd#3500 recommends the same variable, and workerd#4020 documents that nodejs_compat tls ignores the ca option.

### Please provide any relevant error logs

2026-08-16T… workerd/utilities.c++:…: exception: (wdErrId=…) kj/compat/tls.c++:269: failed: TLS peer's certificate is not trusted; reason = unable to get local issuer certificate
(copy one full stack block from your paste, the frames are all identical aside from wdErrId)

Start in the @cloudflare/vite-plugin dev path and compare its workerd setup with wrangler dev, then review the NODE_EXTRA_CA_CERTS handling described in miniflare#587 and workerd#3500. Reproduce the NixOS case with a TLS endpoint using the provided Hyperdrive connection setup; done means outbound TLS succeeds without manually setting NODE_EXTRA_CA_CERTS.

Written by the indexing model from the issue text.