chore(dev): improve local kind development and add Zed launcher (#14683)

docs/craft/dev/local-kubernetes.md

@@ -127,7 +127,7 @@ kubectl -n onyx get pods -w
 ```
 
 The chart pins images to the `:edge` tag in
-[`values-localdev.yaml`](/deployment/helm/charts/onyx/values-localdev.yaml)
+[`values-localdev.yaml`](/deployment/helm/dev/values-localdev.yaml)
 with `pullPolicy: Always`, so in-cluster pods track nightly builds off `main`
 rather than the released `:latest`.
 
@@ -311,7 +311,7 @@ kind load docker-image onyxdotapp/onyx-backend:dev --name onyx-dev
 # so the nightly :edge tag refreshes.
 helm upgrade onyx deployment/helm/charts/onyx \
   -n onyx \
-  -f deployment/helm/charts/onyx/values-localdev.yaml \
+  -f deployment/helm/dev/values-localdev.yaml \
   --set global.pullPolicy=IfNotPresent \
   --set api.image.tag=dev \
   --set celery_shared.image.tag=dev
@@ -382,6 +382,45 @@ before launching the api_server.
 
 ## Troubleshooting
 
+### VPN or proxy certificate errors
+
+For `x509: certificate signed by unknown authority` or `CERTIFICATE_VERIFY_FAILED`,
+obtain your proxy's root CA from IT. Save it as a PEM `.crt` outside the repository.
+Setup scripts do not install certificates. Keep TLS verification enabled.
+
+If `docker pull` fails, follow [Docker's CA setup](https://docs.docker.com/engine/network/ca-certs/).
+If only kind image pulls fail, run this in Bash with your CA path:
+
+```bash
+set -euo pipefail
+onyx_local_ca="/absolute/path/to/company-root.crt"
+deployment/helm/dev/k8s-up.sh --skip-helm
+onyx_local_nodes="$(kind get nodes --name onyx-dev)"
+for onyx_local_node in $onyx_local_nodes; do
+  docker cp "$onyx_local_ca" "$onyx_local_node:/usr/local/share/ca-certificates/onyx-local-proxy.crt"
+  docker exec "$onyx_local_node" update-ca-certificates
+  docker exec "$onyx_local_node" systemctl restart containerd
+done
+make craft-up
+```
+
+For local client errors, build a bundle from the repository root:
+
+```bash
+set -euo pipefail
+onyx_local_ca="/absolute/path/to/company-root.crt"
+mkdir -p "$HOME/.onyx-dev"
+onyx_public_ca="$(.venv/bin/python -m certifi)"
+cat "$onyx_public_ca" "$onyx_local_ca" > "$HOME/.onyx-dev/manual-ca-bundle.crt"
+```
+
+Set `SSL_CERT_FILE` and `REQUESTS_CA_BUNDLE` to the bundle's absolute path in `.vscode/.env.k8s`.
+Set `NODE_EXTRA_CA_CERTS` to the root CA's absolute path in `.vscode/.env.web`. Restart the services.
+
+After CA rotation or removal, replace or remove the node certificate, run `update-ca-certificates --fresh`, and restart containerd.
+Rebuild the local bundle and update client settings. Repeat node setup after cluster recreation.
+Node trust does not configure certificates inside application pods.
+
 ### Sandbox pods stuck in `ImagePullBackOff`
 
 **Symptoms:** Pods in the `onyx-sandboxes` namespace fail to start, with