Get Central Yamato Proxy Root Ca

Deliver the provider shared root CA to a booting proxy over authenticated TLS.

The root CA private key is intentionally never placed in cloud-init user data (durable and broadly readable via cloud APIs, IMDS, and launch templates). A booting proxy fetches it once here, authenticated by its deployment sync token and gated to a short post-provision window, then persists it locally.