Remove bundled TLS roots once ureq's native-tls-no-default support is fixed

[CodeZeno]

When attempting to switch ureq from native-tls to native-tls-no-default to remove the unused webpki-root-certs dependency, an issue was discovered.

Both our polling and updater agents explicitly use TlsProvider::NativeTls with RootCerts::PlatformVerifier, so certificate validation should continue using the Windows certificate store without bundled Mozilla roots. This matches the feature's documented purpose.

Blocker

In our locked ureq 3.4.0, the native TLS module, connector registration, and provider availability check are gated on native-tls. Enabling only native-tls-no-default therefore leaves the connector unavailable.

Once an HTTPS request establishes its TCP connection, it can panic with:

uri scheme is https, provider is NativeTls but feature is not enabled: native-tls

This affects provider polling and update downloads. A smoke test against a closed port misses the problem because the connection fails before reaching the TLS checks.

Temporary workaround

Keep features = ["native-tls", "json"] with default features disabled. Retain PlatformVerifier and accept the bundled root dependency until the upstream issue is resolved.

Completion criteria

• Link the upstream ureq issue/fix and identify a released version containing it.
• Upgrade ureq and switch to native-tls-no-default.
• Confirm both production agents reach a TLS handshake without panicking.
• Verify valid HTTPS requests succeed and invalid certificates remain rejected.
• Confirm webpki-root-certs disappears from the resolved dependency tree.
• Run the release build, Clippy, and tests; record the executable size change.
• Update the version and changelog when reintroducing the change.

[CodeZeno]

For tracking: algesten/ureq#1204