Sandbox2 pytorch_inference: verify TLS trust-bundle path per supported distro #3200

Summary

allowlistedEtcFiles() in the pytorch_inference Sandbox2 filesystem policy may need a distro-specific TLS CA bundle path. The in-code NOTE currently references /etc/ssl/certs/ca-certificates.crt (Debian/Ubuntu) while ml-cpp CI uses a CentOS7/RHEL-based image whose equivalent is /etc/pki/tls/certs/ca-bundle.crt.

Context

PR #3185 adds a minimized /etc allowlist for pytorch_inference Sandbox2 policy. The CA bundle path has not been verified against every supported production distro layout.

Ask

• Confirm which trust-bundle path(s) pytorch_inference/libtorch actually open at runtime on supported Linux distros.
• Add the correct path(s) to allowlistedEtcFiles() (or document why none is needed).
• Align CI/probe coverage with the chosen path.

Tracked from review thread on #3185 (edsavage).