fix(ca-trust): see a malformed BEGIN line instead of skipping it

Codex review against the real merge base, P1 and the only finding.

The marker pattern described a WELL-FORMED opener, so an over-dashed one
(`-----BEGIN CERTIFICATE-------`) matched nothing at all and the block became
invisible to the guard: nothing was checked, and our CA later in the file
carried the verdict. openssl does not skip it — it consumes the line as an
opener and then fails the ENTIRE extras load on the END it cannot match.
Measured, node v24.11.1: guard=accept, loader=0 CAs, `bad end line`.

A trailing `.*` makes the line match, which is all the fix needs: the block is
then seen and the existing per-block check rejects it as an undecodable
CERTIFICATE. Being SEEN is what a guard needs; skipping is what lets a bad
block through.

This is the same defect already fixed on the END side, in its mirror position.
The lesson: a shape fixed at one marker is a shape to go and check at the other.

Two rows: the malformed opener rejects, and a BEGIN wearing one trailing space
still ACCEPTS, so the fix cannot drift into the over-strict guard this PR set
out to remove.

Mutation-checked: reverting to the strict pattern fails the new row.

An earlier attempt added a separate pre-scan loop and an `undefined` label
branch. The branch was dead — `(?!-----)` still captures `CERTIFICATE` from an
over-dashed line — and the mutation SURVIVED, which is what exposed it. Removed
rather than kept as defence for a case that cannot happen.

Suite 1505/1507, the 2 being the inotify EMFILE that fails identically at the
merge base.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: codeslake

bin/ca-trust.mjs

@@ -71,7 +71,20 @@ export function bundleCarriesOurCA(text, ourCaPem) {
   // `-` is legal INSIDE a label, so the stop condition is the `-----` run, not
   // the first hyphen: `[^-]*` failed to match `X-FOO` at all, which is the same
   // blind spot in a new place.
-  const marker = /^-----BEGIN ((?:(?!-----).)*)-----[ \t]*$/gm;
+  // The trailing `.*` is load-bearing: it makes a malformed opener VISIBLE so
+  // the existing per-block checks can reject it. Without it the pattern
+  // described only a well-formed marker, so `-----BEGIN CERTIFICATE-------`
+  // matched nothing at all, the block was skipped, and our CA later in the file
+  // carried the verdict. openssl does not skip it — it consumes the line as an
+  // opener and fails the entire extras load on the END it cannot match.
+  // Measured, node v24.11.1: guard=accept, loader=0 CAs, `bad end line`; now the
+  // block is seen and rejected as an undecodable CERTIFICATE.
+  //
+  // Exactly the defect already fixed on the END side, in its mirror position.
+  // The lesson worth keeping: a shape fixed at one marker is a shape to go and
+  // check at the other. Being SEEN is what a guard needs; skipping is what lets
+  // a bad block through.
+  const marker = /^-----BEGIN ((?:(?!-----).)*)-----[ \t]*.*$/gm;
   let carriesUs = false;
   for (let m; (m = marker.exec(text)); ) {
     const label = m[1];

test/proxy-forward-ca.test.mjs

@@ -434,6 +434,18 @@ test("ca-trust: the bundle guard never accepts a bundle NODE_EXTRA_CA_CERTS cann
       // of these were measured as false accepts on an otherwise healthy bundle.
       ["END marker with trailing garbage", ours.replace("-----END CERTIFICATE-----", "-----END CERTIFICATE-----garbage"), false],
       ["END marker with extra dashes", ours.replace("-----END CERTIFICATE-----", "-----END CERTIFICATE-------"), false],
+      // The SAME defect on the BEGIN side, which the END fix above did not cover.
+      // `$`-anchoring the marker made an over-dashed opener invisible to us — the
+      // block was skipped entirely, so nothing was ever checked and our CA later
+      // in the file carried the verdict. openssl does NOT skip it: it consumes
+      // the line as an opener and then fails the whole extras load on the END it
+      // cannot match. Measured, node v24.11.1: guard=accept, loader=0 CAs,
+      // `bad end line`. A block we cannot parse must never be one we ignore.
+      ["BEGIN marker with extra dashes", `-----BEGIN CERTIFICATE-------\nZm9vYmFy\n-----END CERTIFICATE-----\n${ours}`, false],
+      // ...and the trailing-whitespace tolerance on BEGIN must survive the fix,
+      // for the same reason the END side keeps it: openssl accepts it and so
+      // must we, or we drop a healthy bundle.
+      ["BEGIN marker with a trailing space", ours.replace("-----BEGIN CERTIFICATE-----", "-----BEGIN CERTIFICATE----- "), true],
       // ...but trailing whitespace is fine, and must stay fine: node loads it.
       ["END marker with a trailing space", ours.replace("-----END CERTIFICATE-----", "-----END CERTIFICATE----- "), true],
       // Real cert, just not ours: the stale-builder case.