pub fn ensure_crypto_provider()Expand description
Install the process-wide rustls crypto provider (aws-lc-rs).
ADR-0002: bindcar’s own TLS listener and kube’s client stack may enable
different rustls provider features; with more than one provider feature
enabled, rustls has no compile-time default and the first
ServerConfig::builder() panics with “no process-level CryptoProvider”.
Installing explicitly makes the provider deterministic: aws-lc-rs, which
carries the X25519MLKEM768 hybrid post-quantum key exchange.
Idempotent: an already-installed provider is left in place, so this is
safe to call from main(), from build_server_config and from tests
in any order.