Function system_root_store 

pub fn system_root_store() -> RootCertStore

REL-08 (#219): the OS-native root CA store as a rustls RootCertStore. Loaded via rustls-native-certs, which reads the platform trust store (macOS keychain, Linux CA bundle, Windows root store). Used by upstreams that opt into use_system_roots instead of the bundled webpki set. Failures to load native certs fall back to the webpki set rather than failing every TLS handshake, because a missing OS trust store is a deployment mistake, not a security decision — and the operator’s intent (“trust the OS”) is best approximated by “trust what we have” rather than “trust nothing”.