the newest trust root was missing from the page that lists them

`[system.ca_certificates]` shipped with a CHANGELOG entry and a commented
example, and no prose anywhere. Two of the three gaps that leaves are the
ones a stranger hits.

SECURITY.md's "Your declaration is the trust boundary" enumerates every
string you can name to opt into a trust root, and did not name the most
direct one on the list: a certificate there is trusted for every TLS
connection the machine makes. That is the same defect 0.10 fixed in this
file when it claimed kuma adds no third-party repositories while
mesa_freeworld() was adding RPM Fusion on every desktop build.

concepts.md gains the section the feature never got. The completeness test
cannot catch this: its row is Declared("system"), and a Declared row only
asserts the schema section exists, so prose is outside what it can see.

Also fixes the table of contents, which was missing three sections. Both
0.13 commits that added one (the permissions page, the out-of-scope page)
left it unlinked, and 0.12's menu section did too.

Author: Letdown2491

SECURITY.md

@@ -59,6 +59,14 @@ into each:
   into the image.
 - **`services.enable`** starts units that are already in the image. It cannot
   introduce one.
+- **`system.ca_certificates`** is trust in a certificate authority, and it is
+  the most direct entry on this list: a certificate named there is trusted for
+  every TLS connection the machine makes, by every program that reads the
+  system trust store. It is copied to `/etc/pki/ca-trust/source/anchors/` and
+  `update-ca-trust` runs in the same build layer. `kuma check` rejects a value
+  that is not a PEM certificate, and rejects one containing a private key
+  outright rather than warning, because a key there would be baked
+  world-readable into every image built from that declaration.
 
 Names in these lists are validated before they reach dnf, flatpak, systemctl,
 or brew: no leading dashes, so a name can't become a flag, and no shell

docs/concepts.md

@@ -8,10 +8,14 @@ and [the glossary](glossary.md) defines the vocabulary.
 - [What happens to changes you make by hand](#what-happens-to-changes-you-make-by-hand)
 - [Where the base system comes from](#where-the-base-system-comes-from)
 - [What every image carries](#what-every-image-carries)
+- [The menu](#the-menu)
 - [Why a desktop installs things you did not name](#why-a-desktop-installs-things-you-did-not-name)
 - [What a build records: kuma.lock](#what-a-build-records-kumalock)
 - [What updates itself, and what waits for you](#what-updates-itself-and-what-waits-for-you)
 - [Why a file you edited by hand keeps winning](#why-a-file-you-edited-by-hand-keeps-winning)
+- [Permissions, and a file kuma does not own](#permissions-and-a-file-kuma-does-not-own)
+- [What your machine trusts](#what-your-machine-trusts)
+- [What a declaration does not reproduce](#what-a-declaration-does-not-reproduce)
 - [Boot health and automatic rollback](#boot-health-and-automatic-rollback)
 - [What an install decides that a declaration cannot](#what-an-install-decides-that-a-declaration-cannot)
 
@@ -444,6 +448,49 @@ into a home. One app declares into one store: flatpak merges the two with the
 user store winning per key, so an app declared in both would be a file where
 half your lines quietly lose to the other half.
 
+## What your machine trusts
+
+Every TLS connection the machine makes is checked against a set of certificate
+authorities, and that set is state of an awkward kind. You add to it by
+dropping a file in a directory and running a command, it survives every
+rebuild because it lives in `/etc`, and afterwards nothing on the machine
+says why it is there. A machine could trust something its declaration could
+not say.
+
+`[system.ca_certificates]` says it, keyed by the name each anchor gets on
+disk:
+
+```toml
+[system.ca_certificates]
+"my-root-ca" = """
+-----BEGIN CERTIFICATE-----
+MIIBkTCB+wIJAKZ...
+-----END CERTIFICATE-----
+"""
+```
+
+**The certificate goes in the file rather than beside it.** A declaration that
+points at a path somewhere else is not one file any more: carry it to a second
+machine and the anchor is missing, with nothing to say so.
+
+Inlining is safe here for a reason that does not generalise, and the boundary
+is worth stating exactly. **A CA certificate is public by construction.** A
+private key is not, so one pasted into this table is refused rather than
+warned about: it would otherwise be baked world-readable into every image
+built from the file and pushed to a registry. That is `[user]`'s
+password-hash boundary, one file format over. A value that is not a
+certificate at all is refused by `kuma check` for the ordinary reason.
+
+The anchor is copied to `/etc/pki/ca-trust/source/anchors/` and
+`update-ca-trust` runs in the same build layer that adds it, rather than being
+left for a boot to remember. Landing under `/etc` also puts it inside the
+`etc` check above, so a local edit that ever shadows it is reported rather
+than silently winning.
+
+Adding a trust root is the most consequential thing this file can do in one
+line, which is why it is named again in `SECURITY.md` alongside the other
+roots a declaration opts into.
+
 ## What a declaration does not reproduce
 
 A machine that boots from this image carries state the file never mentions,