Mount system CA roots for OAuth HTTPS requests

README.md

@@ -29,6 +29,17 @@ Google OAuth 的授权回调地址为 `https://api.foundry.entroia.com/auth/goog
 
 用同一个 Google 测试账号分别登录两个项目，确认用户 ID 不同。用 A 的会话请求 B 的 `me` 应返回 401。验证兑换码重放被拒绝，并确认退出 A 后 B 的会话仍有效。
 
+## Runtime HTTPS trust
+
+The Go backend needs an operating-system CA bundle for Google and Slack HTTPS
+requests. The `node:24-bookworm-slim` runtime does not include that trust store;
+Node's own successful HTTPS checks do not validate Go's trust configuration.
+`deploy/release.sh` mounts the deployment host's
+`/etc/ssl/certs/ca-certificates.crt` read-only and sets `SSL_CERT_FILE` to that
+path. The deployment fails before switching traffic if the host bundle is
+missing or unreadable in the candidate. Keep TLS certificate verification
+enabled and maintain the deployment host's trusted CA package.
+
 ## Codex execution
 
 When enabled, `POST /projects/{project}/codex/exec` accepts a JSON object