ci(sfw): restore VP_INSECURE_TLS — sfw v1.11.0 still has the EKU bug

The dropped-VP_INSECURE_TLS experiment confirmed via the now-readable
error chain that sfw v1.11.0 (releases/latest as of 2026-05-28) still
issues a CA cert with a present-but-empty Extended Key Usage:

  error sending request for url (https://nodejs.org/.../SHASUMS256.txt):
    client error (Connect): invalid peer certificate: UnknownIssuer

(The new error-chain formatter from f105aa9 made the actual rustls
reason visible — previously the same failure looked like a generic
"error sending request" with no hint.)

macOS happened to pass without the flag only because that runner had
Node 22.18.0 already cached, so vp didn't have to fetch SHASUMS via
sfw — not a real fix.

Restore VP_INSECURE_TLS=1 on the sfw step (scoped to that step only
to keep build/setup steps unaffected). The plumbing — HTTPS_PROXY +
SSL_CERT_FILE + add_root_certificate — is still exercised end-to-end;
only certificate *validity* is bypassed until SocketDev/sfw-free#30
and #43 ship.

Author: fengmk2

.github/workflows/ci.yml

@@ -982,6 +982,18 @@ jobs:
         run: sfw --version
 
       - name: Run `sfw vp install` against a real repo
+        # TODO(SocketDev/sfw-free#30, SocketDev/sfw-free#43): drop `VP_INSECURE_TLS`
+        # once sfw ships the EKU fix. Verified against sfw v1.11.0
+        # (releases/latest as of 2026-05-28) on Linux: vp's HTTPS request to
+        # nodejs.org through sfw still fails with
+        #   "invalid peer certificate: UnknownIssuer"
+        # because sfw's CA carries a present-but-empty Extended Key Usage
+        # extension that rustls rejects. macOS happened to pass only because
+        # the runner already has Node 22.18.0 cached, so vp didn't have to
+        # traverse sfw for SHASUMS — not a fix. Keep this flag on every
+        # matrix entry until upstream ships the EKU fix.
+        env:
+          VP_INSECURE_TLS: '1'
         run: |
           set -euo pipefail
           # Force the registry-fetch path: install a pinned pnpm globally so