fix: install ca-certificates in reth runtime image for HTTPS sequencer

[crazywriter1]

Summary

Install ca-certificates in the reth runtime image so op-reth can initialize its HTTPS sequencer client.

The final reth image is based on ubuntu:noble, which does not include a default CA bundle. At runtime, op-reth fails when connecting to the configured sequencer endpoint.

Problem

Without a system CA bundle, op-reth exits during startup with: Failed to init reqwest client for sequencer: builder error unexpected error: No CA certificates were loaded from the system

Fix

Mirror the existing op-node image pattern and install ca-certificates in the reth runtime stage.

Test plan

• Verified base ubuntu:noble image has no default CA bundle
• Reproduced runtime failure via docker compose up -d execution
• After installing ca-certificates, TLS handshake to sepolia-sequencer.giwa.io succeeds
• Verified fixed image includes /etc/ssl/certs/ca-certificates.crt
• Verified docker compose up -d execution no longer fails with missing CA certificates

[crazywriter1]

Note: This addresses the remaining gap for the current reth-only setup. PR #2 targeted geth/node but geth has since been removed and op-node already installs ca-certificates. @ihooni

[ihooni]

Thanks @crazywriter1! This mirrors the existing op-node ca-certificates fix (be8e684), and the diagnosis is clear: the ubuntu:noble runtime stage ships no CA bundle, so op-reth's HTTPS sequencer client fails to initialize. Consistent with how we handle the op-node image. LGTM 🙏

[crazywriter1]

Thanks @crazywriter1! This mirrors the existing op-node ca-certificates fix (be8e684), and the diagnosis is clear: the ubuntu:noble runtime stage ships no CA bundle, so op-reth's HTTPS sequencer client fails to initialize. Consistent with how we handle the op-node image. LGTM 🙏

Thanks for the review sir. 🙏

[ihooni]

Could you rebase onto the latest main? We keep history linear, so I'd like to rebase before merging. Thanks!

[crazywriter1]

Could you rebase onto the latest main? We keep history linear, so I'd like to rebase before merging. Thanks!

Done.

[ihooni]

Thanks for the rebase! The new commit 3f117bb is unsigned though, and main requires signed commits — so the merge is blocked. Could you re-sign it (e.g. git commit --amend -S && git push --force, with commit.gpgsign enabled)? Then we're good to merge.

[crazywriter1]

Thanks for the rebase! The new commit 3f117bb is unsigned though, and main requires signed commits — so the merge is blocked. Could you re-sign it (e.g. git commit --amend -S && git push --force, with commit.gpgsign enabled)? Then we're good to merge.

Re-signed the commit with SSH signing. Ready to merge. Thanks sir. @ihooni