fix(images): refresh ca-certificates in scratch runtime images
Merged
MA
1d ago+18+18+01234567890123456789-1-1-0123456789
Summary
The control-plane, CAS, and CLI images are built FROM scratch and copy the Debian ca-certificates bundle out of the digest-pinned golang builder without refreshing it. That freezes the trust store at whatever shipped in the pinned builder, so the images keep trusting roots that have since been distrusted upstream (such as the compromised emSign ECC Root CA - G3).
This refreshes ca-certificates in each builder stage before it is copied into the scratch stage, so every rebuild ships the current distrust list regardless of the base-image digest. The migrations image is unaffected as it carries no CA bundle.
Closes ENG-515