fix(proxy): add strict MITM certificate identifiers

[germondai]

What

• add non-critical SKI to MITM roots and SKI/AKI to leaf certificates
• migrate legacy roots atomically while preserving the CA identity and private key
• fail safely for invalid, mismatched, incomplete, or concurrently initialized CA state
• document the fingerprint change and trust-store re-import procedure

Testing

• bun run verify
• 371 tests pass, including openssl verify -x509_strict and a two-process initialization race test

Closes #113