Unable to get issuer certificate” / AggregateError: Failed to list models on macOS

### Describe the bug

On macOS (Apple Silicon, macOS 15.x), Prompting in Copilot CLI fails with:

`[ERROR] Error making GitHub API request: Error: unable to get issuer certificate; …
[DEBUG] Failed to fetch models from https://api.*.githubcopilot.com: TypeError: fetch failed
AggregateError: Failed to list models`

even though:
• no proxy / VPN / firewall is active
• no TLS or proxy environment variables are set
• curl and standalone node fetch() work correctly

The failure appears to be specific to the embedded Node runtime used by Copilot CLI when validating the certificate chain for api.individual.githubcopilot.com.

### Affected version

0.0.394 Commit: 3d79feb

### Steps to reproduce the behavior

1. Install Copilot CLI on macOS (Apple Silicon, macOS 15.x)
2. Run: 'copilot --log-level debug'
3. Observe repeated errors: 'Error making GitHub API request: Error: unable to get issuer certificate
Failed to fetch models from https://api.individual.githubcopilot.com
AggregateError: Failed to list models'

Diagnostics that succeed:
'node -e "fetch('https://api.individual.githubcopilot.com/mcp/readonly')"
returns 401 (expected without auth)'

Certificate chain verified with:
'openssl s_client -showcerts -connect api.individual.githubcopilot.com:443'

Chain:
'*.individual.githubcopilot.com
→ Sectigo RSA Domain Validation Secure Server CA
→ USERTrust RSA Certification Authority
→ AAA Certificate Services'

### Expected behavior

Expected behavior

Copilot CLI should successfully connect to the Copilot API and list available models on a clean macOS system with valid public certificates, without requiring manual Keychain trust changes.

### Additional context

**Workaround**:
Setting AAA Certificate Services to Always Trust in Keychain Access fixes the issue:
1. Keychain Access → System Roots
2. Find AAA Certificate Services
3. Set Trust → Always Trust
4. Reboot
5. Copilot CLI works correcly now
6. Set Trust back to "Use System Defaults" + reboot -> Issue does not reappear.

This suggests a trust-store mismatch between macOS and the embedded Node runtime used by Copilot CLI.

Related issue: #333 (certificate trust handling)
**Related issue2:**
Recent macOS embedded Node TLS trust issue reported in VS Code Remote:
https://github.com/microsoft/vscode-remote-release/issues/11425
(same “AAA Certificate Services” root trust workaround fixes the problem).

Environment
• Operating system: macOS Sequoia 15.x
• CPU architecture: ARM (Apple Silicon)
• Copilot CLI: 0.0.394
• Embedded Node: v24.11.1
• Terminal: Apple Terminal
• Shell: zsh

Logs were captured using:

copilot --log-level debug --log-dir ./copilot-logs