Look up the machine's certificates rather than the build machine's

A build carries the OpenSSL of the machine it was built on, and that
OpenSSL has one directory compiled into it as the only place it looks for
certificates. For an AppImage built on Ubuntu that is /usr/lib/ssl, which
Arch, Fedora and openSUSE do not have, so on any of them every HTTPS
request fails with CERTIFICATE_VERIFY_FAILED: transcription and cleanup
report it as a rejected key, and the model downloads fail too.

Ask the machine instead, from the list curl and Go use, and only when the
build's own answer turns out not to exist. The store on the machine
rather than a copy carried along, because a copy goes stale as roots are
rotated and would ignore a certificate somebody added themselves. Anybody
who has already set SSL_CERT_FILE is left alone.

packaging/entry.py

@@ -7,8 +7,9 @@ The Finder hands a double-clicked application a -psn_0_… argument naming the
 process serial number, which argparse reads as a flag it has never heard of and
 exits over, and no one clicking an icon would ever find out why.
 
-The two environment lines have to run before anything starts another process,
-and before is easier to be sure of here than anywhere further in.
+The three environment lines have to run before anything starts a process,
+opens a connection or reaches for ffmpeg, and before is easier to be sure of
+here than anywhere further in.
 """
 
 import sys
@@ -18,6 +19,7 @@ from dikte.app import main
 
 if __name__ == "__main__":
     integrate.restore_library_path()
+    integrate.use_system_certificates()
     integrate.add_bundled_tools()
     sys.argv[1:] = [arg for arg in sys.argv[1:] if not arg.startswith("-psn_")]
     sys.exit(main())