Function client_for 

pub(crate) fn client_for(
    config: Option<&SystemOneConfig>,
    forge_toml: &Path,
) -> Result<Option<SystemOneClient>, WorkspaceError>

Build the decision client for a loaded [systemone] section; None keeps the tools unregistered for every session. The client goes through the same TLS-trust helper the Slack and Gotify legs use, so a NODE_EXTRA_CA_CERTS bundle behaves identically for decisions.