fix: keep injecting NODE_EXTRA_CA_CERTS/DENO_CERT when a build has no system CA store

[dash14]

Summary

• inject() in the inspect engine's buildkit-runc wrapper aborted entirely when the rootfs had no system CA store (findSystemStore error), which also skipped setting NODE_EXTRA_CA_CERTS/DENO_CERT even though those don't need one.
• Base images like node:*-slim have no OS CA store but Node itself does TLS fine normally (it uses its own bundled roots), so this only surfaced once the inspect engine tried to make the step trust the proxy's CA — e.g. corepack enable failing with SELF_SIGNED_CERT_IN_CHAIN.
• Now only the variables that actually need the system store (REQUESTS_CA_BUNDLE, PIP_CERT, SSL_CERT_FILE, and the store itself as an append target) are skipped when it's absent; NODE_EXTRA_CA_CERTS/DENO_CERT still get their own dedicated CA file regardless.
• Updated docs/inspect-engine.md's Limitations section to describe the new, narrower scope of this gap.