Scope startup CA roots to prepared children

[winston-openai]

Why

Unix startup CA overrides should not be copied into the stable managed MITM bundle before child filesystem policy is evaluated. The preceding PRs now prepare every sandboxed child environment, so this trust narrowing can land without breaking startup CA compatibility.

What

• omit startup file-backed CA overrides from the stable managed bundle on Unix
• continue embedding startup file-backed roots on Windows, where the restricted sandbox identity is persistent
• keep startup values available for policy-checked per-child materialization

Stack

• Parent: Prepare managed child MITM CA env #25888
• This is the final trust-scope stage.

Validation

• just test -p codex-network-proxy managed_ca_trust_bundle_scopes_startup_ca_override_by_platform
• the full codex-network-proxy suite passed on the same final stack