[craig-kindo]

What

• Trust a supplemental PEM CA bundle only for the matching policy endpoint, alongside system roots. Validate the bundle and reject incompatible tls: skip / protocol: tcp policies; TLS inspection and credential injection continue to apply.
• Accept upstream_ca_pem in the policy advisor proposal API. CA proposals always require human review, and approval writes the CA into that sandbox's policy with hot reload.
• Route advisor and denial gateway RPCs through fleet members, avoid the binary - placeholder in proposed rules, and point L4 denials at policy.local when proposals are enabled.

Why

This is the fork companion needed by the two small mono policy PRs: Helm values overrides need endpoint CA trust, and user reviewed overrides need a working advisor and its CA proposal lane.

This PR does not add or remove VPN technology, remove the egress gateway, or change network mode wiring. It is a parallel path to existing fork PR #12 and covers the same functional lanes with fewer supplemental tests.

Verification

• cargo fmt --all -- --check passed.
• Tests for the six touched Rust crates passed, with two environment-dependent tests skipped (fleet DNS test: local localhost resolves through external DNS; TLS file watcher test: timeout in this sandbox). Writable TMPDIR and XDG_STATE_HOME were used.
• cargo clippy for the six touched crates and all targets passed, with warnings in unchanged code and one non-Send generic warning in the fleet retry helper.
• mise run pre-commit reached license checking and failed on the existing missing SPDX header in crates/openshell-core/src/gateway_channels.rs. The new test file's header has been fixed.

The CA lane and advisor fixes were previously k3d verified on their source branches.