What does this PR do?

ssl.SSLCertVerificationError inherits from SSLError → OSError → ValueError. The is_local_validation_error guard in run_agent.py caught it via isinstance(api_error, ValueError) and triggered a non-retryable abort — even though the error classifier already returns retryable=True for all OSError subclasses (transport heuristic, step 7).

The inline isinstance check fires before classified.retryable is consulted, so the classifier's correct verdict is overridden. Fix: add ssl.SSLError to the exclusion tuple alongside the existing UnicodeEncodeError, mirroring the same pattern already in place.

Related Issue

Fixes #14367

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• run_agent.py: add import ssl (stdlib, no new dependency); extend exclusion tuple to (UnicodeEncodeError, ssl.SSLError) with inline comment explaining the MRO
• tests/run_agent/test_14367_ssl_local_validation.py: new test file covering the reported case (SSLCertVerificationError), the parent class (ssl.SSLError), the MRO prerequisite, the preserved UnicodeEncodeError exclusion, and regression checks that plain ValueError/TypeError remain local errors

How to Test

1. Confirm the MRO that caused the bug:

   import ssl
   e = ssl.SSLCertVerificationError("cert error")
   print(isinstance(e, ValueError))  # True — this was the root cause

2. Run the new tests:

   pytest tests/run_agent/test_14367_ssl_local_validation.py -v

3. All 7 tests should pass.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A