Propagate the agent CA bundle into Python and nix-direnv

[jimpudar]

Summary

• Export the MITM CA bundle through the agent VM for Python, pip, uv, botocore, curl, git, and related SDKs.
• Re-assert the same CA env after direnv/nix-direnv loads a project shell so dev shells keep trusting the instance CA.
• Centralize the CA env setup in the rootcell runner and reuse it during VM provisioning.

Testing

• bun run test:unit:vitest
• Nix expression parsing for agent-vm.nix and home.nix
• bun run lint
• bun run typecheck