Java proxy trust store: reuse system store, configurable type

What

• Before building a new Java trust store for the agent proxy's certificate authority (CA, used to intercept and inspect traffic for tool safety), Claude Code now checks whether the machine's own Java trust store already trusts that CA. If it does, that existing store is reused directly instead of building a merged one.
• A new javaTrustStoreType setting is now required alongside javaTrustStorePath when constructing JAVA_TOOL_OPTIONS. Previously the trust store type was always assumed to be PKCS12; now it can be set explicitly.

Why

This avoids unnecessary rebuilding of the trust store when the system already trusts the proxy's CA, and makes the setup work with Java trust stores that aren't in PKCS12 format.