Shared truststore (cloud + TLS + CA PEM only; null otherwise). Built once per JVM, deleted on JVM exit.