fix(relay): reject non-exclusive Android trust roots

[jeremi]

Summary

• fail closed when Relay is configured with a custom PostgreSQL trust root on Android
• leave Android system trust unchanged when no custom root is configured
• document the platform limitation
• cover rejection before any TLS builder mutation

native-tls reloads Android's system certificate directory after clearing the OpenSSL root store, so the exclusive trust-root guarantee introduced by #471 cannot be enforced on that platform. Rejecting this configuration is the smallest safe behavior.

This follow-up was identified by Codex review on the review-only component PR #475 immediately before #471 merged.

Verification

• cargo test --locked -p registry-relay --lib (720 passed, 6 ignored)
• focused state-plane runtime tests (7 passed)
• cargo clippy --locked -p registry-relay --lib --tests -- -D warnings
• cargo fmt --check
• git diff --check
• independent security review found no actionable issues

Android cross-compilation was not run because the Android Rust target is not installed.

Signed-off-by: Jeremi Piotrowski jpiotrowski@worldbank.org