feat(ebpf-poc): manage the proxy CA and npm trust

Redirecting a package manager into the proxy is only half the job. The
client then has to trust the proxy's certificate, and npm will not,
because Node from nodejs.org compiles its own roots into the binary and
ignores the system trust store.

Adds `pmgwatch ca` with install, status and remove.

install persists a CA keypair through PMG's own certmanager, so the
certificate survives a proxy restart. Without a persisted CA the daemon
generates an ephemeral one on every start and trust has to be redone
each time. The private key is left owned by the proxy user at 0600, and
a separate public bundle is written for npm, so npm never needs access
to the key.

npm is configured through `npm config set cafile --location=user`, run
as the target user. Environment variables that could shadow that config
are stripped from the child so the read-back verification is
meaningful. The previous cafile is recorded and restored on remove.

install refuses to run while the proxy is up, since the daemon reads the
certificate at startup, and refuses to change options against existing
state so a half-migrated setup cannot happen.

ebpf-poc/go.mod

@@ -1,7 +1,18 @@
 module ebpf-poc
 
-go 1.25.0
+go 1.25.1
 
 require github.com/cilium/ebpf v0.22.0
 
-require golang.org/x/sys v0.43.0 // indirect
+require (
+	github.com/safedep/dry v0.0.0-20260716095238-84cd2b3cd3a4 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
+)
+
+require github.com/safedep/pmg v0.0.0
+
+replace github.com/safedep/pmg => ..