Agent proxy can install its CA into the system trust store 'directly' via a new anchor/layout path, not just via a refresh helper

Claude Code runs a local agent proxy that needs its certificate authority (CA) trusted by the system so it can inspect secure connections. Installing that certificate into the system trust store now tries a new 'direct' method first, writing the certificate to an anchor location, before falling back to the previous approach of refreshing it through a helper command. Diagnostic telemetry now records which method succeeded (direct or refresh) and gives more detailed failure reasons, such as direct_failed_step, direct_skipped, and hook_incomplete.