feat(rustd): one crypto provider — aws-lc-rs replaces ring, reqwest 0.13, object_store

Indy directed that the Fleet Bundle store land in THIS milestone rather than a
follow-up, and separately that the workspace track the latest crates. Those two
decide the crypto backend, so it is decided here rather than discovered at §4.4.

`object_store` 0.14 enables `aws-lc-rs` as a DEFAULT feature with no ring
alternative, and `reqwest` 0.13 collapsed its TLS features so plain `rustls`
forces the same. M176 pinned reqwest to 0.12 precisely to stop a second
`CryptoProvider` appearing beside ring — but `object_store` forces one
regardless, so the pin can no longer deliver what it was for. It is released
deliberately, not forgotten, and the workspace resolves to ONE provider:

    cargo tree -i ring        →  nothing to print
    cargo tree -i aws-lc-rs   →  afd_identity, reqwest, redis, sqlx-core

Three objections were raised against doing this inside M177 and TWO WERE WRONG
on facts that had not been checked. Recorded rather than quietly dropped:

  - "aws-lc-sys needs cmake." It does not, at 1.18/0.44 — it built here on
    Apple clang with no cmake installed. What is TRUE and was overstated: that
    was macOS/arm64, natively. The container compiles nothing (it COPYs a
    pre-built binary), CI is ubuntu-latest and unproven until this pushes, and
    the musl cross-compile is genuinely unknown.
  - "It breaks the linux cross-compile." CI ships no Rust binary today —
    `release.yml` builds only the Zig daemon for musl — so that risk is a
    cutover (M181) concern, and it is better discovered now than then.
  - "R5 / Files Changed." Real, and fixed: `afd_identity` is now a declared row.

Two behaviour changes are ACCEPTED and named rather than absorbed:

  - The no-C-linkage posture ends. `aws-lc-sys` is a BoringSSL fork that
    compiles C. That posture is stated four times in this manifest and it is
    now false; the comments say so where they used to claim otherwise.
  - reqwest 0.13 REMOVED `webpki-roots`. Trust anchors come from
    `rustls-platform-verifier` — the system store — where 0.12 shipped them in
    the binary. A slim container without `ca-certificates` would now fail to
    verify where it used to succeed. `Dockerfile` installs it, which is what
    makes this safe rather than merely survivable.

"ring-compatible" proved to mean "compatible when you ask", and the first
attempt at it was wrong in a way worth keeping visible. `RsaKeyPair::public()`
is `public_key()` on the `KeyPair` trait; the components conversion and
`modulus_len` sit behind `ring-io`. Both compat features are aws-lc-rs defaults,
and the first fix enabled both because turning defaults off had broken the
build — which is adding features until it compiles.

Reading what each actually gates gives a smaller answer:

  - `ring-sig-verify` is NOT needed. It only preserves ring's
    `VerificationAlgorithm::verify(Input, Input, Input)` and pulls
    `untrusted 0.7.1`. The verifier this workspace calls,
    `RsaPublicKeyComponents::verify` (aws-lc-rs `src/rsa/key.rs:635`), is
    ungated and already takes `&[u8]`. Dropped, and the suite stays green.
  - `ring-io` is needed by ONE signing test, so it is declared on
    `afd_identity`'s dev-dependency rather than in the workspace defaults —
    where it names who needs it instead of quietly applying to the library.

The library therefore carries no ring-compatibility shim at all. A shim added to
silence a build is a shim nobody removes.

`sqlx` moves from `tls-rustls-ring-webpki` to `tls-rustls-aws-lc-rs`; `redis`
is untouched, because its `tls-rustls` enables `rustls/std` and picks no
provider. `jsonwebtoken` 11 is registered with the `aws_lc_rs` backend for the
credential mint: it is JWT semantics, not a backend, and hand-rolling header
and claims JSON, base64url segments and expiry validation on top of a primitive
library is the plumbing that earns a CVE for saving a dependency.

MILESTONE-ID fired on a `§4.4` marker in a manifest comment and was fixed by
describing the behaviour, not by carving out the gate (RULE TST-NAM).

Verified: `cargo test --workspace --all-features` 564 passed / 0 failed / 57
ignored — up from the 560 baseline, with the whole crypto backend swapped
underneath. `cargo clippy --workspace --all-features` clean under the full deny
set. `make harness-verify` ALL GATES GREEN.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>