Rustls system trust anchor loading across Linux distributions with varying certificate bundle paths

Goal

Configure a Rustls-based client to reliably load the operating system's trusted root certificates on Linux without bundling a fixed root store.

Constraints and uncertainty

The rustls-native-certs crate attempts to locate system certificate bundles at common paths such as /etc/ssl/certs/ca-certificates.crt (Debian/Ubuntu) and /etc/pki/tls/certs/ca-bundle.crt (Fedora/RHEL). However, the crate does not guarantee discovery on every distribution, and minimal or distroless container images often omit these files entirely. There is no standardized Rust API to enumerate system trust anchors, so fallback behavior varies between crates and may panic or return an empty list when the expected store is absent.

Questions

1. What is the recommended strategy to ensure Rustls loads system CAs consistently across major Linux families without requiring the OpenSSL development headers at build time?
2. How should an application detect and handle the case where rustls-native-certs returns zero trust anchors in a containerized environment?
3. Is there a portable pattern to merge system roots with a bundled Mozilla root set (via webpki-roots) so that enterprise CAs added to the host store are still honored?