Clearer certificate errors for cross-certificate chains and proxies

What

TLS is the encryption behind secure connections, and it relies on a chain of certificates leading to a trusted authority. On company networks a proxy or firewall often breaks that chain. Several changes help Claude Code explain what went wrong.

• Code-specific messages: for some SSL error codes, the error is now a hint for that code. Other codes keep the general advice to set NODE_EXTRA_CA_CERTS to your CA bundle path if you are behind a corporate proxy or TLS-intercepting firewall.
• Missing root: on UNABLE_TO_GET_ISSUER_CERT_LOCALLY, when the chain runs through a cross-certificate in your computer's certificate store, a new message tells you to add the root certificate or have the proxy send the cross-certificate. A cross-certificate is a certificate that links one authority to another.
• Unsigned cross-certificates: cross-certificates that loop in the system store are checked for whether a certificate in the store signed their issuer, and those that were not are reported as unsigned. If the check fails, it is logged and the issuer is treated as present.
• Proxies: reading the server's certificate chain now works through https:// proxies and verifies the proxy's own certificate. The advice says to set https_proxy, which is read first, to a complete http:// or https:// URL. Fetching managed settings retries after the chain is restored.
• Wording: the guidance about PEM files (a common certificate file format) in the NODE_EXTRA_CA_CERTS warnings was reworded.

Why

Certificate errors behind corporate proxies are hard to diagnose from a generic message. These changes point more directly at the missing piece, whether that is a root certificate, a cross-certificate, or the proxy setup.