fix: bootstrap SSL/CA for research CLI on corporate MacBooks

Extract app/ssl_bootstrap.py (shared with FastAPI main), wire it into research
scripts, and teach run_tier1_macbook.sh to locate combined-ca-bundle.pem, certifi,
optional USE_CORP_PROXY, plus --ssl-check diagnostics.

scripts/run_earnings_research.py

@@ -28,6 +28,10 @@ ROOT = Path(__file__).resolve().parents[1]
 if str(ROOT) not in sys.path:
     sys.path.insert(0, str(ROOT))
 
+from app.ssl_bootstrap import bootstrap_ssl  # noqa: E402
+
+bootstrap_ssl()
+
 IRON_IC_BAR = 0.03
 MIN_RELIABLE = 12
 SUE_CARRY_DAYS = 63