Capella root CA path is non-portable; unit test asserts a forward-slash suffix and fails on Windows BUG

[celticht32]

Summary

_get_capella_root_ca_path in src/cb_mcp/utils/index_utils.py builds the fallback
certificate path with os.path.join, which yields OS-native separators
(src\cb_mcp\certs\capella_root_ca.pem on Windows). The unit test in
tests/unit/test_utils.py asserts the path with a hard-coded forward slash:

assert result.endswith("certs/capella_root_ca.pem")

On Windows the produced path ends with certs\capella_root_ca.pem, so endswith
fails and the test errors. CI runs on ubuntu-latest (forward slashes), so this is
green in CI but red for any contributor developing on Windows.

How to reproduce

On Windows:

uv run pytest tests/unit/test_utils.py -k capella

Two tests fail with:

assert '...src\\cb_mcp\\certs\\capella_root_ca.pem'.endswith('certs/capella_root_ca.pem')

Verified this session: our unit suite is green on Linux; these two are the only
failures, and only on Windows path semantics.

Impact

• Windows contributors get spurious local test failures unrelated to their changes.
• The assertion is testing a string suffix rather than path equality, which is
  brittle regardless of platform.

Suggested fix

Make the test path-separator agnostic, e.g. compare with os.path:

import os
assert os.path.basename(result) == "capella_root_ca.pem"
assert os.path.basename(os.path.dirname(result)) == "certs"

or normalize before comparing:

assert result.replace(os.sep, "/").endswith("certs/capella_root_ca.pem")

The production code is arguably fine (native separators are correct for the OS); the
fix belongs in the test. If cross-platform string stability is desired from the
helper itself, have it return a pathlib.PurePosixPath-style string, but that is a
larger change and not required to fix the test.