docs(podman): document macOS socket path mismatch and dynamic lookup

.agents/skills/debug-openshell-cluster/SKILL.md

@@ -193,9 +193,18 @@ podman logs <container> --tail=200
 openshell status
 ```
 
+On macOS with Homebrew Podman, the API socket may not exist at the default
+probe path. If `podman machine list` shows a running machine but the gateway
+reports the socket as missing, resolve the dynamic path:
+
+```bash
+podman machine inspect --format '{{.ConnectionInfo.PodmanSocket.Path}}'
+export OPENSHELL_PODMAN_SOCKET="$(podman machine inspect --format '{{.ConnectionInfo.PodmanSocket.Path}}')"
+```
+
 Common findings:
 
-- Podman socket unavailable: start or expose the user socket.
+- Podman socket unavailable: start or expose the user socket. On macOS, also check the socket path mismatch described above.
 - Rootless networking unavailable: inspect Podman network configuration.
 - Sandbox image missing or pull denied: verify image reference and registry credentials.
 - Sandbox fails before readiness with an identity-resolution error: inspect the image's OCI `USER` and matching `/etc/passwd` and `/etc/group` entries, or explicitly set both process identity fields in policy. Root and missing identities are rejected.

.github/workflows/branch-checks.yml

@@ -127,6 +127,9 @@ jobs:
       - name: Verify telemetry can be compiled out
         run: mise run rust:verify:telemetry-off
 
+      - name: Verify system CA roots build mode compiles and excludes bundled Mozilla roots
+        run: mise run rust:verify:system-ca-roots
+
       - name: sccache stats
         if: always()
         run: |