Agent proxy CA bootstrap now retries with budget instead of failing once

Agent proxy startup (CCR relay) now fetches and merges the CA bundle through a budgeted, retryable helper, with a 5-second budget on the first attempt and 15 seconds on later attempts. A background retry loop keeps retrying with backoff until it succeeds, the generation changes, or shutdown occurs, instead of giving up after the first CA fetch failure.