Disabled TLS verification — `verify=False` and friends

# Python
import os, requests, ssl, warnings

if os.environ.get("ENV") not in ("dev-local", "test"):
    _orig_request = requests.Session.request

    def _safe_request(self, method, url, *, verify=True, **kw):
        if verify is False:
            raise ssl.SSLError(
                f"TLS verification is required (request to {url})"
            )
        return _orig_request(self, method, url, verify=verify, **kw)

    requests.Session.request = _safe_request

You are remediating disabled-TLS-verification call sites.
Output a PR or a TRIAGE.md.

## Step 0 — Inventory

1. Grep for `verify=False`, `verify = False`,
   `rejectUnauthorized: false`, `InsecureSkipVerify: true`,
   `HostnameVerifier((h,s)->true)`, `setDefaultHostnameVerifier`,
   `TrustManager` overrides, `--insecure` / `-k` curl flags,
   and the env-var overrides listed in the recipe.
2. For each call site, classify the reason: self-signed cert
   in dev, internal CA missing, broken cert chain, proxy in
   path, or unknown.

## Step 1 — Pick the strategy per call site

- **Self-signed dev cert / internal CA:** uplift — install
  the CA into the application's trust bundle.
- **Broken cert chain:** uplift — fix the chain (intermediate
  cert missing).
- **Proxy in path:** uplift — install the proxy's CA into the
  trust store; do not disable verification.
- **Unknown:** triage.

## Step 2 — Uplift

For each call site, do the language-appropriate fix:

- **Python:** pass `verify="/path/to/ca-bundle"` or
  `verify=True` with the CA installed via `certifi.where()`
  + a startup script that merges in the org CA.
- **Node:** load the CA via `tls.createSecureContext({ ca:
  ... })` and pass that as the agent's secure context.
- **Java:** load the CA into the JVM `cacerts` keystore (or
  application-specific keystore) and remove trust-all
  TrustManagers.
- **Go:** populate `RootCAs` on the TLS config; remove
  `InsecureSkipVerify`.
- **curl:** install the CA via `--cacert` or set
  `CURL_CA_BUNDLE`; remove `--insecure`.

## Step 3 — Install the fail-closed shim (when chosen)

For codebases with many call sites, install the import-time
shim at the application entry point. The shim should:

1. Allow `verify=False` only when an explicit
   `ENV=dev-local` (or equivalent) environment variable is
   set.
2. Otherwise raise `SSLError` immediately.
3. Log every shim activation so test environments are
   visible in audit.

## Step 4 — Tests

Add tests:

- A request to a server with a valid certificate succeeds.
- A request to a server with a self-signed certificate (in
  test env) succeeds *only* when an explicit `verify=...`
  argument names that cert.
- In a non-test environment, a `verify=False` call raises.

## Step 5 — Open the PR

- Branch: `remediate/tls-verify-<module-slug>`.
- Title: `[Security][TLS] re-enable verification across <module>`.
- Body: call-site inventory, reason per site, uplift chosen,
  shim installation, test additions.
- Label: `sec-auto-remediation`.

## Stop conditions

- A genuinely insecure-by-design integration (e.g., a legacy
  partner endpoint that has no valid cert and cannot get one).
  Do not auto-disable verification — flag and triage; the
  right path is a network-isolated proxy.
- The reason a site disabled verification cannot be
  classified.
- A test infrastructure depends on `verify=False` and the
  agent cannot reshape it without touching test infra.

## Scope

- Do not modify CI test infrastructure.
- Do not bundle unrelated refactors.
- Do not silently widen the shim's "allowed in dev" scope.