fix: pin cryptography<49 to restore macOS x86_64 wheel support

cryptography 49.0.0 dropped macOS x86_64 wheel publishing and switched
to AWS-LC as its Rust backend. Building from source on macos-15-intel
produces a _rust.abi3.so that references _SSL_get0_group_name (an AWS-LC
extension), but PyInstaller bundles standard OpenSSL's libssl.3.dylib
which lacks this symbol, causing a crash at runtime.

Pinning to <49 ensures pip selects 48.0.1, which ships a universal2
wheel with a properly delocated OpenSSL for both arm64 and x86_64.
Reverts the now-unnecessary OPENSSL_DIR workflow workaround.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: alexrashed

.github/workflows/build.yml

@@ -51,19 +51,10 @@ jobs:
       - name: Create virtual environment
         uses: nick-fields/retry@v4
         with:
-          timeout_minutes: 10
+          timeout_minutes: 5
           max_attempts: 5
           retry_wait_seconds: 120
           command: make clean-venv venv
-        env:
-          # cryptography has no pre-built wheel for macOS x86_64 and builds from
-          # source via Rust. PKG_CONFIG_PATH (set by setup-python) points to
-          # Python's own OpenSSL, which can have newer headers than the Homebrew
-          # libssl.3.dylib that PyInstaller later bundles — causing a
-          # symbol-not-found crash at runtime. Pinning OPENSSL_DIR to Homebrew
-          # ensures openssl-sys compiles and links against the exact same dylib
-          # that PyInstaller will bundle.
-          OPENSSL_DIR: ${{ matrix.runner == 'macos-15-intel' && '/usr/local/opt/openssl@3' || '' }}
 
       - name: Build using pyinstaller
         shell: bash

requirements.txt

@@ -1,3 +1,4 @@
 pyinstaller
 localstack==2026.5.0
 cookiecutter==2.6.0
+cryptography<49