Google Colab Runtime and Python Requests: Custom CA Trust Across Ephemeral VM Sessions

When a notebook must call an internal API that presents a privately issued certificate, the goal is for Python's requests library inside Google Colab to validate that endpoint without disabling TLS verification. The runtime is an ephemeral Linux VM with root access, so changes to the system CA store or the certifi bundle are possible during a session. However, because the disk is reset when the runtime disconnects or recycles, it is not clear whether Colab offers a supported integration point to make a custom root CA persist across sessions or to propagate it automatically into both the system trust store and the bundle that requests actually consults.

This ambiguity matters for workflows that reconnect frequently and cannot rely on manual reconfiguration after every restart. The behavior may differ depending on whether the certificate is added to the operating system's trust anchors, to the Python environment's certifi package, or to a custom bundle passed at request time, and it may also depend on how the Colab runtime restores the filesystem.

Does Google Colab expose a documented mechanism for persisting custom CA certificates across VM restarts? If so, does that mechanism update the certifi bundle used by requests, or only the system-level store? Are there version-specific differences in current Colab runtimes that affect how trust anchors are restored?