node001: distrust the roots above the compromised eMudhra intermediates

The private keys of eight eMudhra intermediates are recoverable
(https://emudhra.we-have-a-problem.com). node001 runs NixOS 25.11 from
March with nss-cacert 3.121, and curl there still accepted a chain via
emSign ECC Root CA - G3. Blacklist that root and Comodo AAA Services root
until nixpkgs ships NSS 3.131.1. Everything node001 talks to chains to
ISRG Root X1.

Already deployed with ./cli update node001, and Gatus, ntfy and Stalwart
were restarted so they reload the trust store.

nix-infra-machine/nodes/node001.nix

@@ -122,6 +122,17 @@ in
     80    # HTTP (ACME)
   ];
 
+  # ──────────────────────────────────────────────
+  # Trust store
+  # ──────────────────────────────────────────────
+  # Distrust the roots above the compromised eMudhra intermediates until
+  # nixpkgs ships NSS 3.131.1, see https://emudhra.we-have-a-problem.com.
+  # Everything this box talks to chains to ISRG Root X1.
+  security.pki.caCertificateBlacklist = [
+    "Comodo AAA Services root"
+    "emSign ECC Root CA - G3"
+  ];
+
   # ──────────────────────────────────────────────
   # ACME / Let's Encrypt
   # ──────────────────────────────────────────────