Codex setup fails with CERTIFICATE_VERIFY_FAILED in Binary Ninja

Setup Codex fails immediately in Binary Ninja:

<urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed:
unable to get local issuer certificate (_ssl.c:997)>

Binary Ninja's bundled bnpython3 is a repackaged python.org build. Its OpenSSL is compiled with

OPENSSLDIR: "/Library/Frameworks/Python.framework/Versions/3.10/etc/openssl"

which does not exist unless python.org Python is separately installed. So ssl.create_default_context() loads zero CA certificates and every urllib HTTPS request fails:

$ bnpython3 probe.py
cafile: /Library/Frameworks/Python.framework/Versions/3.10/etc/openssl/cert.pem False
TLS FAIL: [SSL: CERTIFICATE_VERIFY_FAILED] ...

$ SSL_CERT_FILE=/etc/ssl/cert.pem bnpython3 probe.py
TLS OK

This hits the urllib call sites only. Providers on the OpenAI/Anthropic SDKs are fine because httpx defaults to the certifi bundle. Affected: the four urlopen calls in codex_provider.py (including the post-401 refresh retry) and the one in ollama_provider.py, which matters when OLLAMA_BASE_URL points at an https host.

Rikugan on Binary Ninja 5.1, macOS.