fix(plugins): trust platform certificates

Use the operating system trust store and Windows proxy settings while keeping TLS verification enabled. Add retryable registry errors with copyable diagnostics.\n\nRefs #563

src/network.rs

@@ -0,0 +1,35 @@
+//! Shared native HTTP client configuration.
+//!
+//! Desktop requests use the operating system's certificate verifier so roots
+//! installed by administrators, corporate proxies, and security software are
+//! honoured without weakening TLS verification.
+
+#![cfg(not(target_arch = "wasm32"))]
+
+use std::time::Duration;
+use ureq::tls::{RootCerts, TlsConfig};
+
+pub(crate) fn agent(timeout: Duration) -> ureq::Agent {
+    let tls = TlsConfig::builder()
+        .root_certs(RootCerts::PlatformVerifier)
+        .build();
+    ureq::Agent::config_builder()
+        .timeout_global(Some(timeout))
+        .tls_config(tls)
+        .build()
+        .into()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn agent_uses_platform_verifier_without_disabling_tls() {
+        let agent = agent(Duration::from_secs(1));
+        let tls = agent.config().tls_config();
+
+        assert!(matches!(tls.root_certs(), &RootCerts::PlatformVerifier));
+        assert!(!tls.disable_verification());
+    }
+}