v0.3.8 — export the CA bundle from the settings page

0.3.8

New: the CA bundle can be exported from the settings page.

caPemPath: auto has always pointed at <DSH_HOME>/context-mode/ca/windows-roots.pem — a file this package has never shipped. On a fresh machine it simply is not there, so a network behind a TLS-inspecting proxy stays unable to fetch, and the only clue was an ENOENT in a status line.

The row under caPemPath now reports whether that file exists and offers a button that writes it from the host's own root store (tls.getCACertificates('system')).

• Loading only stats the file. Presence is a statSync; taking the snapshot (~500 certificates, ~820 KB, tens of ms) happens only when the button is pressed. An assertion pins that apply() never reads the bundle.
• An existing bundle is never replaced on one click. The first press asks; only the explicit confirmation sends force.
• What it does not do: it exports the system store. If the proxy root was never installed into that store, the exported bundle is still not enough — the row says so rather than promising a fix.
• The route is POST /_dsh/context-toolkit/export-ca, registered through the same ctx.inject(['webServer']) seam as the status route, so a host without a web server still loads the plugin.

Gates: offline 99 (5 new), client 27, packaging 20, release 34.

Full Changelog: v0.3.7...v0.3.8