perf(build): converge Reqwest on Rustls

[limityan]

Summary

• keep workspace Reqwest transport/data-only and make each real HTTP client owner select Rustls explicitly
• converge explicit builders on tls_backend_rustls() and preserve platform certificate verification
• remove the obsolete Windows prebuilt OpenSSL bootstrap from local build paths and three existing workflows
• guard direct declarations, Cargo-decoded feature ownership, unknown consumers, target-specific/renamed duplicates, and the resolved Reqwest feature union against a second TLS backend

This is not another MCP architecture follow-up. MCP ownership and behavior are unchanged; its remote HTTP transport only participates in the repository-wide Reqwest backend convergence. product-full is not used as a convenience dependency gate.

Architecture and scope

• workspace reqwest owns only the shared version plus HTTP/serialization/stream capabilities
• CLI, Desktop, AI adapters, MiniApp Market, and every Services Reqwest capability select Rustls at their actual owner boundary
• URL-only Core remains TLS-free in its minimum profile
• the standalone Installer keeps its existing Reqwest 0.12 Rustls profile and is only covered by the dependency-policy guard
• all current repository Reqwest consumers have explicit metadata profiles; a future unregistered consumer fails the existing boundary check
• no CI job, matrix entry, or test step was added; three obsolete OpenSSL setup steps were removed

Dependency impact

Profile	Before	After	Delta
Core minimum	118	118	0
Core product-full (Windows)	712	707	-5
Services MCP (Windows)	256	250	-6
AI adapters (Windows)	205	199	-6
CLI (Windows)	827	822	-5
Desktop (Windows)	1028	1023	-5

Cargo.lock drops 5 packages: hyper-tls, native-tls, openssl, openssl-macros, and tokio-native-tls. openssl-sys remains only on the non-Windows Git/libgit2 path; it is absent from the Windows Desktop graph.

Local verification

• pnpm run check:core-boundaries:test ? 40/40 passed
• pnpm run check:core-boundaries ? passed
• GitHub workflow configuration tests ? 8/8 passed
• Desktop Tauri build-script tests ? 3/3 passed
• cargo check --locked -p bitfun-services-integrations --no-default-features --features mcp
• cargo check --locked -p bitfun-ai-adapters
• cargo check --locked -p bitfun-desktop
• focused MCP contract/streamable HTTP, Review Platform HTTP, and AI client tests passed
• Windows dependency assertions confirm Rustls platform verification and no Native TLS/OpenSSL packages
• git diff --check ? passed

Risk and follow-up

The behavioral change is the Review Platform client moving from Native TLS to the same Rustls platform verifier already used by the other Reqwest clients. The repository has no Reqwest client-identity or custom native connector usage. System-trusted certificates remain supported; untrusted self-signed certificates remain rejected by default. Live enterprise proxy/custom certificate environments were not manually exercised and remain CI/product validation evidence rather than a claimed local pass.

Remote CI

• CI run 30785286276 ? 7/7 jobs passed
• Windows, macOS, and Linux Rust Build Check jobs all completed successfully without the removed OpenSSL setup
• Frontend Build, Ubuntu/macOS CLI Tests, and Shell Deploy Scripts also passed