feature: git, gh and ssh keep working with Cortex running

Feature Description

Cortex terminates TLS for traffic in its path. Anything else on the machine that speaks HTTPS
is collateral: if trusting ~/.cortex/ca/ca.crt breaks git push or gh pr create, nobody
leaves Cortex running — and these failures tend to be intermittent rather than obvious.

This issue covers the tools that use the OS trust store. Tools with their own trust store are
tracked separately.

Proposed Solution

• git clone / fetch / push over HTTPS and over SSH
• gh CLI: auth, PR and issue operations
• ssh and scp
• Callers that pin certificates or pass --cacert fail loudly with an actionable message,
  never intermittently
• Document which tools need the CA and which are passed through untouched

Additional Context

Part of the Cortex v0.9.0 release. Gates exit criterion 2 (Cortex is invisible to everything
else). Related: #912 — a CA trust failure currently degrades into intermittent slowness
instead of a clear error.