Add pip-system-certs (Windows) for corporate TLS proxy + doc note

Author: mbaronnet

docs/run/run_data_sync.md

@@ -41,10 +41,13 @@ same "publish" action — you don't manage this by hand.
 
 ## One-time setup (per machine)
 
-1. Install the dependencies (DVC is included):
+1. Install the dependencies (DVC + `pip-system-certs` on Windows are included):
    ```bash
    pip install -r requirements.txt
    ```
+   On a corporate (e.g. World Bank) laptop, `pip-system-certs` makes Python trust the
+   network's TLS proxy — without it, publishing fails intermittently with
+   `CERTIFICATE_VERIFY_FAILED`.
 2. Add your store keys: copy `tools/.env.example` to `tools/.env` and paste the 4 values
    (ask the store admin).
    ```

requirements.txt

@@ -23,5 +23,6 @@ mcp
 # Data publishing/sync to private store (R2/S3) — see docs/run/run_data_sync.md
 dvc[s3]
 s3fs
+pip-system-certs ; platform_system == "Windows"  # trust corporate TLS proxy (avoids SSL errors on WB laptops)
 # Optional (Monte Carlo analysis only):
 # chaospy==4.3.18