Create Admin Yamato Root Ca

Create a provider's shared proxy root CA if it does not exist.

Idempotent and first-writer-wins: an existing root is returned unchanged and is never replaced, so envs that already trust it stay valid.