fix: bootstrap SSL/CA for research CLI on corporate MacBooks

Extract app/ssl_bootstrap.py (shared with FastAPI main), wire it into research
scripts, and teach run_tier1_macbook.sh to locate combined-ca-bundle.pem, certifi,
optional USE_CORP_PROXY, plus --ssl-check diagnostics.

scripts/build_ticker_sector_map.py

@@ -34,6 +34,10 @@ ROOT = Path(__file__).resolve().parents[1]
 if str(ROOT) not in sys.path:
     sys.path.insert(0, str(ROOT))
 
+from app.ssl_bootstrap import bootstrap_ssl  # noqa: E402
+
+bootstrap_ssl()
+
 from app.services.sector_map import (  # noqa: E402
     DEFAULT_SECTOR_MAP_PATH,
     coverage_stats,