fix(security): verify deployed trust before dependency work

.github/workflows/ci.yml

@@ -155,6 +155,17 @@ jobs:
         if: steps.docs-check.outputs.docs_only != 'true'
         with:
           python-version: "3.11"
+      # Establish system trust before dependency installers or their hooks run.
+      # Keep one apt pass for FFmpeg and bubblewrap; containment is checked later.
+      - name: Install FFmpeg and bubblewrap and validate system CA trust
+        if: steps.docs-check.outputs.docs_only != 'true'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends ffmpeg bubblewrap ca-certificates
+          python scripts/check_ca_trust.py --system
+          command -v ffmpeg
+          ffmpeg -version | head -n 1
+
       # uv resolves the same versions as pip but installs ~5x faster, and its
       # cache keeps each shard from re-downloading the whole requirement set.
       - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
@@ -166,6 +177,7 @@ jobs:
           prune-cache: false
       - run: |
           uv pip install --system --require-hashes --only-binary=:all: --no-deps -r requirements-bootstrap.txt
+          python scripts/check_ca_trust.py --python
           uv pip install --system -r requirements.txt
         if: steps.docs-check.outputs.docs_only != 'true'
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
@@ -187,16 +199,6 @@ jobs:
         if: steps.docs-check.outputs.docs_only != 'true'
       - run: mkdir -p data  # sqlite DB lives at ./data/app.db
         if: steps.docs-check.outputs.docs_only != 'true'
-      # One apt pass for FFmpeg (media integration tests) and bubblewrap
-      # (containment, verified in the next step).
-      - name: Install FFmpeg and bubblewrap
-        if: steps.docs-check.outputs.docs_only != 'true'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends ffmpeg bubblewrap ca-certificates
-          command -v ffmpeg
-          ffmpeg -version | head -n 1
-
       - name: Validate Python and system CA trust
         if: steps.docs-check.outputs.docs_only != 'true'
         run: python scripts/check_ca_trust.py --system --python