fix: install the rustls CryptoProvider unconditionally
The default-provider install was gated behind the u5c feature, but the multi-provider panic affects any TLS path that relies on rustls' process default (gcp/elasticsearch/hydra/mithril via reqwest/tungstenite), not just u5c. Make rustls a non-optional dep and run the install for every build so no feature combination can hard-crash on the first TLS handshake. The install is idempotent (the Result is ignored), so it's a no-op when a provider is already set, and the AWS SDK still uses its own provider. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>