## Summary - install Debian's `ca-certificates` bundle in the final Chopin image - keep the package cache out of the resulting layer - allow the native Copilot CLI to construct its outbound HTTPS client independently of inbound TLS termination

## Testing - `bun run ci` - `docker compose -f compose.yaml -f compose.local.yaml build app` - verified `/etc/ssl/certs/ca-certificates.crt` exists and is non-empty in the production image - started Copilot SDK `1.0.11` with native CLI `1.0.80`, `env: {}`, and an intentionally invalid `ghu_` token inside the image - token validation now reaches GitHub and returns `401 Bad credentials` rather than `network fetch failed: builder error`