Refresh expired pinned custom-CA fixture with preserved TLS assertions

Parent: #66. Found during #703's native-only comparison of 78 previously omitted files.

The unchanged pinned test/js/bun/test/parallel/test-http-should-accept-custom-certs-when-provided.ts fails in both Home and the pinned Bun control with CERT_HAS_EXPIRED. On the actual host date, 2026-09-08 UTC, its server certificate test/js/node/http/fixtures/openssl_localhost.crt is expired: notBefore 2024-05-25 12:32:27 GMT; notAfter 2026-08-25 12:32:27 GMT. The CA openssl_localhost_ca.pem is valid until 2034-05-25. OpenSSL inspection independently confirms those dates.

Both first outcomes are retained in zig-out/bun-port-703/newly-discovered-runs/043-{home,bun}.log. Runtime source 82156e60d; Bun pin 4982b91e3702094330f3be3883354c52b8c01323. Pinned executable source and certificate bytes remain unchanged. This is a pinned fixture-validity problem, not evidence of a Home-specific TLS regression.

Resolve fixture maintenance transparently while retaining the original trust-chain and custom-CA assertions and a clear pinned baseline. Do not disable certificate validation, spoof time, skip the test or count a matching failure as a passing feature. Any maintained fixture revision must be separately identified and verified in both runtimes. The unmodified baseline remains failing until a legitimate fixture revision is adopted; full parity must not be claimed from this comparison alone.

Resolved on main by f0327d434.

Home now carries the exact three-file renewal from Bun's verified upstream commit 15c936cd9387. SHA-256 comparison against GitHub's content API is byte-for-byte exact for the leaf certificate, private key and CA certificate. OpenSSL verifies the chain and matching leaf/private public key; the leaf covers localhost and 127.0.0.1, is valid from 2026-08-25 through 2126-08-01, and retains TLS server authentication.

The unchanged test-http-should-accept-custom-certs-when-provided.ts succeeds with certificate verification enabled under both the fresh Home ReleaseFast binary and pinned Bun 4982b91e3. Home records the native script process as passing; pinned Bun exits 0 after the original top-level assertion. No clock spoofing, validation disablement, skip, assertion, workload or deadline change was used. The fresh ReleaseFast build passes 46/46 steps.

The full 12,996-entry corpus integrity audit now records the three adopted TLS fixtures explicitly in packages/runtime/test/HOME_FIXTURE_REVISIONS.json. Their bytes and blob identities were independently rechecked against Bun commit 15c936cd93878f44724c79869753b85e8b9b2f2c through GitHub’s content API; OpenSSL verifies the chain, localhost/IP coverage and matching private/public key. The #710 renewal is preserved, and maintained HTTPS controls now use owned fixture paths. Source and audit evidence are on main. Current execution controls remain queued and receive no new pass credit from integrity checks alone.