ssl get_ca_certs() undercounts: capath certs don't show, TLS still verifies

Don't measure a Python trust store with len(ctx.get_ca_certs()). On Debian/Ubuntu, ssl.create_default_context() also loads the hashed capath (/usr/lib/ssl/certs, or SSL_CERT_DIR). Those certs load lazily during verification and never appear in get_ca_certs(). Tested on Python 3.12.3: with SSL_CERT_FILE='' the count is 0, and with SSL_CERT_FILE=one-cert.pem it's 1, yet a handshake to a public site still succeeds in both cases. Only setting SSL_CERT_DIR='' as well makes it fail. httpx 0.28.1 differs: it passes cafile= explicitly (certifi, or SSL_CERT_FILE if set), which skips capath. So SSL_CERT_FILE pointing at a bare corporate root really does break public HTTPS in httpx but not in urllib. Verify with an actual connection.