fix(cli): join HTTP client uses system trust roots (042 WP4 follow-up)

reqwest's rustls-tls feature bundles webpki-roots, whose
CDLA-Permissive-2.0 license is not on the deny.toml allowlist — make check
failed at cargo-deny. Switch to rustls-tls-native-roots (system trust
store), which also matches how TLS trust works everywhere else in the
workspace. cargo deny is green again; the join unit/mock tests are
unaffected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: lxsaah

Cargo.lock

@@ -59,9 +59,11 @@ serde_yaml = { version = "0.9", optional = true }
 
 # `join` only (design 043): HTTP client for the provisioning endpoint + the
 # GitHub device flow, and TOML for the station profile. rustls so released
-# binaries don't depend on a system OpenSSL.
+# binaries don't depend on a system OpenSSL; native roots (system trust
+# store) rather than the bundled webpki-roots, whose CDLA license is not on
+# the deny.toml allowlist.
 reqwest = { version = "0.12", default-features = false, features = [
-    "rustls-tls",
+    "rustls-tls-native-roots",
     "json",
 ], optional = true }
 toml = { version = "0.8", optional = true }