ci: constrain cryptography<49 only on macos-15-intel runner

Move the pin out of requirements.txt (which affects all platforms) and
into a runner-specific PIP_CONSTRAINT set via GITHUB_ENV. All other
runners continue to get the latest cryptography.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: alexrashed

.github/workflows/build.yml

@@ -45,6 +45,16 @@ jobs:
         with:
           python-version-file: .python-version
 
+      - name: Pin cryptography on macOS Intel
+        # cryptography 49+ dropped macOS x86_64 wheel support and uses AWS-LC as its
+        # Rust backend, producing a _rust.abi3.so that references _SSL_get0_group_name
+        # — a symbol absent from the standard OpenSSL libssl.3.dylib that PyInstaller
+        # bundles. Constrain to <49 to get the last universal2 wheel with bundled OpenSSL.
+        if: matrix.runner == 'macos-15-intel'
+        run: |
+          echo "cryptography<49" > "$RUNNER_TEMP/constraints.txt"
+          echo "PIP_CONSTRAINT=$RUNNER_TEMP/constraints.txt" >> "$GITHUB_ENV"
+
       # Add a retry to avoid issues when this action is running
       # right after the package is published on PyPi
       # (and might not be distributed in the CDN yet)

requirements.txt

@@ -1,4 +1,3 @@
 pyinstaller
 localstack==2026.5.0
 cookiecutter==2.6.0
-cryptography<49