refactor(ssl): collapse the duplicated union arm in _shared_context

The SSL_CERT_FILE (union) arm repeated the platform arm line for line
plus a load_verify_locations call. Build the context from one of two
classes (stdlib for a replacing provider bundle, injected for everything
else) and load the bundle once when there is one.

Equivalence probed on 44a807c2c7 vs this head for (path, False),
(path, True), (None, False): identical type, verify_mode, check_hostname
and cert_store_stats().

Fold3 finding 1 (reuse/quality Low).

agent/ssl_verify.py

@@ -101,20 +101,16 @@ def _shared_context(ca_path: str | None, union: bool = False) -> ssl.SSLContext:
     with _CA_CONTEXTS_LOCK:
         ctx = _CA_CONTEXTS.get((ca_path, union))
         if ctx is None:
-            if union:
-                ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
-                if not _installed:
-                    ctx.load_default_certs()
-                ctx.load_verify_locations(cafile=ca_path)
-            elif ca_path is not None:
+            if ca_path is not None and not union:
                 # PROTOCOL_TLS_CLIENT sets hostname checking and CERT_REQUIRED;
                 # assigning the original class's properties after injection recurses.
                 ctx = _stdlib_ssl_context_class()(ssl.PROTOCOL_TLS_CLIENT)
-                ctx.load_verify_locations(cafile=ca_path)
             else:
                 ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
                 if not _installed:
                     ctx.load_default_certs()
+            if ca_path is not None:
+                ctx.load_verify_locations(cafile=ca_path)
             _CA_CONTEXTS[(ca_path, union)] = ctx
         return ctx