feat(windows): validate GFE/Zscaler host CA trust on Windows #658

🤖: AI agent (OpenCode), filing on behalf of @mogul. Split out of the epic #461 (Increment 2) so it is tracked on its own.

Problem

The Windows host CA behavior is unvalidated: whether a GFE/Zscaler-intercepted network is trusted by the MSB guest on Windows, as it is on macOS/Linux.

Deliverables

• Validate GFE/Zscaler/host CA handling on a real Windows host (live, not mocked).
• Document the result and any required setup or limitation.

Blocked on

A Windows host with WHP and MSB working (see the live-validation issue split out of #461). Trigger to start: that validation succeeds.

Related

#461, #246 (Zscaler CA validation command).