Load a closed BCL certificate's explicit public export

Replace X509Certificate2(cert.Export(X509ContentType.Cert)) only for a local created by an exact BCL X509Certificate2 constructor, CertificateRequest.CreateSelfSigned or byte-array X509CertificateLoader.LoadCertificate. Require exactly the declaration and export receiver uses. Preserve the entire Export invocation, public-only detach intent, algorithms, lifetime and failure handling. Arbitrary/derived receivers, aliases, reassignments, escapes, other formats, passwords/flags, named/commented target calls, lambda/query contexts and snapshots stay unchanged. Opt-in port.