v0.34.3 — works behind TLS-inspecting firewalls

nethackers now works on networks that inspect HTTPS. A corporate firewall or antivirus that re-signs every certificate with its own CA broke every hub call: the browser, gh and git trusted that CA through the OS certificate store, but nethackers checked certificates only against its bundled list. An evolve run on such a network played for hours while every win stayed local-only with CERTIFICATE_VERIFY_FAILED.

Networking

• The OS certificate store counts. HTTPS is verified against your OS trust store as well as the bundled roots, the way pip does. Where IT has installed the inspecting CA in the OS store (on Linux: the system bundle that update-ca-certificates builds), hub calls and registration work.
• Nothing else changes: the bundled roots still apply, so a Linux box or container without a system CA bundle keeps working, and SSL_CERT_FILE is still honored.
• docs/troubleshooting.md says what to ask IT for when the CA isn't in the OS store.

Under the hood

• New dependency: truststore (pure Python), injected once at the CLI entry point. The hub and worker entry points are unchanged.
• Arena rebuilt because uv.lock gained that package, and classified at ARENA_MAJOR=2: the arena never loads it and nothing on the scoring path changed, so the verified corpus carries over.