feat: document vendored-crypto bundling justification for Fedora packaging #3517

Part of: #3511

User Story

As a Fedora package reviewer (or a security-conscious downstream consumer), I want a documented justification for why OpenShell bundles its own TLS/crypto stack instead of using system OpenSSL, so the bundling decision is auditable rather than assumed.

Problem Statement

OpenShell's vendored dependency tree includes aws-lc-rs, aws-lc-sys, ring, and rustls (plus tokio-rustls, quinn) — a full pure-Rust/vendored-C crypto and TLS stack, rather than an OpenSSL-backed implementation. This bypasses Fedora's/RHEL's system-wide crypto-policy enforcement (update-crypto-policies), which is a known, recurring point of scrutiny in Fedora Rust-package reviews, and is also independently flagged internally as a FIPS-compliance blocker for a separate, internal RPM productization effort.

Impact / Why This Matters

Without a documented justification, this is likely to draw direct reviewer pushback during Fedora package review, and it's a shared blocker with a separate internal RPM entitlement effort — resolving or clearly justifying it once here benefits both efforts rather than requiring two separate investigations.

Proposed Design

Investigate whether rustls/aws-lc-rs can be feature-flagged to an OpenSSL-backed alternative without a large refactor; if not feasible in this timeframe, write up the justification as a formal bundling-exception rationale for Fedora review purposes.

Acceptance Criteria

• A written justification (in the spec's header comments and/or a packaging doc) explains why OpenShell's crypto/TLS stack is vendored rather than OpenSSL-backed, whether that's expected to change, and what (if anything) blocks switching
• Explicit coordination noted with the related internal FIPS/crypto-policy effort so both tracks converge on the same answer rather than diverging

Alternatives Considered

• Switch to an OpenSSL-backed TLS stack now — likely the "correct" long-term answer but a much larger cross-cutting change; out of scope for the initial Fedora packaging push, tracked here as a documented gap rather than blocking on a full migration.
• Say nothing and let a reviewer raise it — rejected; better to proactively document this given it's already a known blocker elsewhere.