TLS verification fails behind a TLS-intercepting proxy

Environment

• opensrc 0.7.3, macOS arm64
• Corporate proxy (Zscaler) intercepts TLS and re-signs with its own CA, installed in the macOS system keychain

What happens

$ opensrc path TanStack/form@v1.33.0
Error: error sending request for url (https://api.github.com/repos/TanStack/form)

The same URL returns 200 from curl and node --use-system-ca. NODE_OPTIONS=--use-system-ca and SSL_CERT_FILE have no effect on opensrc.

Why

bin/opensrc.js only spawns the native binary, so Node's trust settings never apply. The binary's HTTP client is built with rustls-tls-webpki-roots:

reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-webpki-roots", "blocking"] }

That embeds the Mozilla CA list at compile time and never reads the OS trust store, so a proxy CA that the OS trusts is rejected. reqwest ships rustls-tls-native-roots for exactly this, but it is not enabled and there is no runtime flag to opt in.