fix: recover cleanly from CA trust refusal

[kev1n77]

Summary

• remove a newly added macOS login-keychain certificate when the user rejects trust
• preserve pre-existing certificates on refusal
• report both trust refusal and cleanup failure when keychain cleanup also fails
• keep the desktop in its existing Proxy/not-trusted state and allow retry
• close the CA-refusal portion of TST-003 documentation

Verification

• npm run desktop:check (39 passed)
• npm run desktop:build
• cargo test -p codeischeap-sidecar-runtime --all-targets (15 passed, 1 ignored interactive Windows CA test)
• cargo clippy -p codeischeap-sidecar-runtime --all-targets -- -D warnings
• cargo fmt --all -- --check
• git diff --check