Updates github.com/kernel/kernel-go-sdk to
e6dff4a41334b0008f7d0469bf83477905cdc589 (v0.85.0).

Full enumeration of all 127 SDK methods in api.md against the CLI command
tree found no missing commands. The only coverage gap was a new param field
on ProxyNewParamsConfigCustom.

New flags on `kernel proxies create`:
- --ca-bundle: inline PEM-encoded CA certificate bundle
- --ca-bundle-file: read the bundle from a file ('-' for stdin)
The two are mutually exclusive; the bundle is rejected early if it is not
PEM-encoded, and warned about (ignored) for non-custom proxy types.

Surfaces the new has_ca_bundle response field:
- `proxies get` / `proxies check`: "Has CA Bundle" row
- `proxies list`: "CA bundle" marker in the Config column
- `proxies create`: confirms the write-only bundle was stored

Tested:
- Real API: `proxies create --type custom --ca-bundle-file` reaches
  server-side ca_bundle validation ("ca_bundle must be 65536 bytes or less,
  got 80569" for an oversized bundle; a valid bundle passes that check and
  only fails the live proxy connection test, as no reachable MITM proxy is
  available from CI). No resources leaked.
- Local mock API: verified the wire body carries the full PEM as `ca_bundle`
  for inline, file, and stdin inputs, and that has_ca_bundle renders in
  create/get/list/check output.
- Flag errors: mutual exclusion, non-PEM input, missing file, non-custom
  warning.
- go build ./..., go vet ./..., go test ./... all pass (6 new unit tests).

Triggered by: kernel/kernel-go-sdk@e6dff4a

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

SDK e6dff4a is the v0.85.0 tag the CLI already pins, so go.mod is unchanged
and the api.md diff against the previous version is empty. A full enumeration
of all 128 SDK methods and 286 request-param fields was performed anyway,
which surfaced pre-existing coverage gaps that are closed here.

Fix broken merge in cmd/proxies:
The merge of main into this branch unioned two independent implementations of
the proxy CA bundle feature, leaving the tree uncompilable (undefined io,
in.CaBundle on a struct without that field). Resolved to main's shipped
--ca-bundle <path> semantics and dropped the duplicate inline/stdin variant,
which would otherwise have silently redefined --ca-bundle for existing users.

New flags:
- kernel auth connections create --record-session / --no-health-checks /
  --no-auto-reauth (ManagedAuthCreateRequestParam.{RecordSession,HealthChecks,
  AutoReauth})
- kernel auth connections update --record-session / --no-record-session,
  --health-checks / --no-health-checks, --auto-reauth / --no-auto-reauth
  (ManagedAuthUpdateRequestParam, tri-state: omitting both leaves the
  connection's current value untouched)
- kernel auth connections login --record-session / --no-record-session
  (AuthConnectionLoginParams.RecordSession, per-login override)
- kernel browsers replays start --record-audio
  (BrowserReplayStartParams.RecordAudio)
- kernel credentials update --remove-value-key
  (UpdateCredentialRequestParam.RemoveValueKeys)

BrowserCurlParams.{TimeoutMs,ResponseEncoding} are intentionally left
unexposed: kernel browsers curl does not call the SDK's Curl method, it
proxies through a raw HTTP client for binary-safe streaming. --max-time
already covers the timeout, and response encoding is meaningless when raw
bytes go straight to stdout.

Tested against the live API:
- auth connections create --record-session --no-health-checks --no-auto-reauth
  -> response echoed record_session=true, health_checks=false,
  auto_reauth=false
- auth connections update, both directions, plus an unrelated-field-only
  update confirming omitted toggles are left untouched
- mutually-exclusive pairs rejected (--health-checks with --no-health-checks)
- credentials update --remove-value-key removed the key; combined with
  --value on the same key, the new value is kept (removal applied first)
- browsers replays start --record-audio -> started, stopped, listed
- request bodies captured against a local listener confirming tri-state on the
  wire: {"record_audio":true} / {} and {"record_session":true} /
  {"record_session":false} / {}
- all test resources deleted; go build, go vet, gofmt and go test ./... pass

Triggered by: kernel/kernel-go-sdk@e6dff4a

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>