nix: CA bundle for tests in the sandbox; README runbook

flake.nix

@@ -31,6 +31,8 @@
           ];
         };
         cargoLock.lockFile = ./Cargo.lock;
+        # The sandbox has no system CA store; the HTTP client needs one to build.
+        SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
         meta.mainProgram = "mailmig";
       };
     in