Decide how the target leg compiles the crypto provider 0243 brings, or which triples leave 0113

[iderex]

0243 decides that a certificate is validated through rustls driving
rustls-platform-verifier, and #27's socket is the change that puts that entry
in the manifest. Every crypto provider rustls offers is C, and the target leg
compiles the library for seven triples on one Linux runner with the pinned
toolchain and no C cross-toolchain at all. So the first cargo build --lib --target after the entry arrives goes red on every triple whose C compiler the
runner does not carry. 0243 measured that, named the ways out, and took none of
them, and no issue on this board holds the choice. #27 cannot land a socket
until it is taken.

What is wrong

The leg compiles each triple in .github/targets/targets on ubuntu-latest,
and that is green today because the graph is pure Rust:

git rev-parse origin/main
5e9a9ecb2f85acc115e843f9a174a87c3bd30d63
grep -n 'runs-on' .github/workflows/targets.yml
69:    runs-on: ubuntu-latest
grep -n 'cargo build' .github/targets/targets.sh
316:    if ! cargo build --locked --lib --target "$triple"; then
cargo metadata --format-version 1 --locked | jq -r '.packages[] | select(.name != "flowfin-core") | .name' | sort | tr '\n' ' '
block-buffer cfg-if cpufeatures crypto-common digest hybrid-array libc sha2 typenum

0243 records that both providers rustls offers carry a native build, that six
of the seven triples failed inside aws-lc-sys's build script on the machine it
was measured on, and that the C cross-toolchain per triple is a prerequisite the
target leg does not have. I re-ran that today in a scratch crate outside this
tree declaring rustls = "0.23" and rustls-platform-verifier = "0.7" and
nothing else, with the toolchain rust-toolchain.toml pins, resolving
rustls v0.23.43, rustls-platform-verifier v0.7.0 and aws-lc-sys v0.45.0.
On this machine, which is Windows and not the runner, three of the triples:

for t in aarch64-apple-ios aarch64-apple-tvos aarch64-linux-android; do cargo check --locked --target "$t"; echo "exit=$?"; done
error occurred in cc-rs: command did not execute successfully (status code exit code: 1): "clang" "-O0" "-fPIC" ... "--target=arm64-apple-ios" "-miphoneos-version-min=7.0" "-isysroot" "...\Swift\Platforms\6.3.3\Windows.platform\Developer\SDKs\Windows.sdk\" ... "-c" "...\aws-lc\generated-src/err_data.c"
exit=101
error occurred in cc-rs: command did not execute successfully (status code exit code: 1): "clang" "-O0" "-fPIC" ... "--target=arm64-apple-tvos" "-mappletvos-version-min=9.0" "-isysroot" "...\Windows.sdk\" ... "-c" "...\aws-lc\generated-src/err_data.c"
exit=101
error occurred in cc-rs: command did not execute successfully (status code exit code: 1): "clang.exe" "--target=aarch64-linux-android" "-O0" "-DANDROID" ...
exit=101

Every failure is inside the C build of the provider and none is in Rust. The
runner's reading would differ in which compilers it finds and not in the shape:
an Apple triple needs an Apple SDK, which does not run on Linux; an Android
triple needs an NDK; the Windows triple needs a cross compiler for the MSVC
target. Which of those the runner image already carries is a claim I have not
measured, and measuring it is the first thing this issue does.

What this decides

Three ways out, each priced in 0243, and none of them is #27's to take:

• The target leg gains a C cross-toolchain per triple: an NDK on the Linux
  runner, and a runner per Apple platform family because an Apple SDK does not
  run on Linux. That changes the shape of .github/workflows/targets.yml, what
  a compile on that leg costs in minutes, and the sentence in
  .github/targets/targets that the set is a set of client platforms and not
  of runners.
• A triple leaves 0113's set until it can be served. 0243 names this as the one
  option that also removes the Android licence term A conjunctive licence expression carries a term 0103's set names in neither half #268 answered, and says a
  triple leaves the set in 0113 rather than in 0243.
• The pure-Rust provider rustls-rustcrypto, which 0243 reads as
  0.0.2-alpha and names as the thing that retires this cost when it reaches a
  stable release. Its version string is the thing to re-read.

A fourth is available and this issue exists to refuse it by name: the transport
landing with a socket and no TLS, on the reading that 0028 honours a typed
http://. That sends a credential in clear over any address the core is handed,
and src/server/transport.rs already says of itself that this is why the
socket is absent.

Done when

The choice is recorded in docs/decisions/: a record superseding 0113 where a
triple leaves the set, or one that goes further than 0243 where the provider or
the leg changes, with the runner's own readings behind it rather than this
machine's. The target leg is green on a tree carrying the dependency. #27 names
that record as what its socket is built under.