refactor(env): group the CA handlers into their own subpackage

The two ca_* handlers sat flat in utils/env/handlers/infinito, which the
prefix-grouping lint rejects, and the bundle-candidates comment exceeded
the .env comment length limit.

tests/unit/python/plugins/filter/test_ca_trust_paths.py

@@ -42,7 +42,7 @@ class TestCaTrustPaths(unittest.TestCase):
 
     def test_env_handler_exports_the_host_spot(self):
         from utils.env.builder import BuildContext, EnvBuilder
-        from utils.env.handlers.infinito import ca_cert_host as handler
+        from utils.env.handlers.infinito.ca import cert_host as handler
 
         eb = EnvBuilder()
         handler.apply(

utils/env/handlers/__init__.py

@@ -15,8 +15,6 @@ from . import (
     passthrough,
 )
 from .infinito import (
-    ca_bundle_candidates,
-    ca_cert_host,
     container,
     distros,
     docker_volume,
@@ -30,6 +28,8 @@ from .infinito import (
     registry_cache_max_size,
     tor_socks_port,
 )
+from .infinito.ca import bundle_candidates as ca_bundle_candidates
+from .infinito.ca import cert_host as ca_cert_host
 from .infinito.dir import backups as dir_backups
 from .infinito.dir import secrets as dir_secrets
 from .infinito.dir import var_lib as dir_var_lib

utils/env/handlers/infinito/ca/__init__.py

@@ -0,0 +1 @@
+"""CA-trust env handlers."""

utils/env/handlers/infinito/ca/bundle_candidates.py

@@ -12,7 +12,7 @@ if TYPE_CHECKING:
     from utils.env.builder import BuildContext, EnvBuilder
 
 KEY = "INFINITO_CA_BUNDLE_CANDIDATES"
-COMMENT = "Extracted CA bundle per distribution layout, most likely first; consumers take the first readable one (SPOT: group_vars/all/05_paths.yml CA_BUNDLE_CANDIDATES)."
+COMMENT = "Extracted CA bundle per distro layout, first readable one wins (SPOT: group_vars/all/05_paths.yml CA_BUNDLE_CANDIDATES)."
 
 
 def apply(eb: EnvBuilder, ctx: BuildContext) -> None: