fix(trust): remove stale system anchors

[rissrice2105-agent]

Summary

• remove an existing system CA anchor even when it never reached the active trust bundle
• rebuild the bundle after cleanup so a later refresh cannot reactivate a root the user already uninstalled
• preserve the existing no-op behavior for genuinely absent roots and non-system stores

Closes #20

Testing

• node --test --test-name-pattern="stale anchor" tests/upstream-and-system-trust.test.ts — 1 passed
• focused TypeScript check for lib/trust.ts and the modified test — passed
• git diff --check — passed

Notes

The regression uses an injected in-memory trust environment and never touches the machine's real certificate stores. The broader trust tests contain existing Linux-path assumptions and an NSS certutil name collision on Windows; the focused regression is platform-safe, and repository CI provides the Linux suite.