feat(ahp-ws): make WebSocket TLS backend selectable, default to rustls

[colbylwilliams]

Why

ahp-ws unconditionally enabled tokio-tungstenite = { features = ["native-tls"] }. Two facts combine to make that decision leak out of this crate and onto everyone downstream:

1. Cargo feature unification unions features across the whole graph, so once a downstream binary shares the same tokio-tungstenite node, native-tls is compiled in for all consumers.
2. tungstenite's auto-connector prefers native-tls — its no-explicit-connector path is gated #[cfg(feature = "native-tls")] first, only falling through to rustls under #[cfg(all(__rustls-tls, not(native-tls)))].

The upshot (documented in github/copilot-host#298): copilotd's request for rustls-tls-native-roots can never win while ahp-ws forces native-tls, and ahp-ws drags OpenSSL onto Linux builds regardless. This moves the lever back into AHP.

What

Gate the WebSocket TLS backend behind Cargo features instead of hard-coding it:

Feature	TLS stack	Trust roots
rustls-tls-native-roots (default)	rustls (pure Rust)	OS trust store
rustls-tls-webpki-roots	rustls (pure Rust)	bundled Mozilla roots
native-tls	platform (SChannel / Secure Transport / OpenSSL)	OS trust store

• tokio-tungstenite now uses default-features = false (just connect + handshake); each feature re-exports the matching tungstenite TLS feature.
• The new default, rustls-tls-native-roots, is a pure-Rust stack — no OpenSSL on Linux — that still validates against the OS trust store, preserving the TLS-intercepting-egress-proxy / enterprise-CA invariant that native-tls provided.
• An optional rustls dep (default-features = false, features = ["ring", "std", "tls12"]) is pulled in by the rustls features so the shared rustls 0.23 node has a crypto provider. Without this, tungstenite's rustls connector calls ClientConfig::builder() → CryptoProvider::get_default() and panics on the first wss:// dial. ring keeps the build portable (no C toolchain, unlike aws-lc-rs).
• With no TLS feature enabled, ws:// still works and wss:// fails at connect time.

Downstreams (e.g. copilotd) can now get rustls for free, or opt back into native-tls with default-features = false, features = ["native-tls"].

Validation

• Builds clean for all four feature combinations (default, native-tls, rustls-tls-webpki-roots, and no-TLS).
• Default dependency tree contains ring + rustls + rustls-native-certs and zero OpenSSL.
• cargo clippy --workspace -- -D warnings, cargo test --workspace, and cargo doc all pass.
• No MSRV regression: every new TLS crate declares MSRV ≤ 1.71, under the workspace's rust-version = "1.75".

CHANGELOG updated under clients/rust/CHANGELOG.md (Added + Changed).

[Copilot]

Pull request overview

This PR updates the Rust ahp-ws WebSocket transport crate to make the wss:// TLS backend selectable via Cargo features, with a rustls-based option intended to be the default, and documents the new behavior for downstream consumers.

Changes:

• Add crate-level Cargo features to select the WebSocket TLS backend (rustls-native-roots default, rustls-webpki-roots, or native-tls).
• Update crate docs/README and inline API docs to describe TLS backend selection and expected behavior when TLS is disabled.
• Add Rust workspace changelog entries and refresh the Rust workspace lockfile to reflect the new dependency graph.

Show a summary per file

File	Description
clients/rust/crates/ahp-ws/src/transport.rs	Updates connect API docs to reflect feature-selected TLS backend for wss://.
clients/rust/crates/ahp-ws/src/lib.rs	Adds crate-level documentation explaining TLS backend feature selection.
clients/rust/crates/ahp-ws/README.md	Updates public README to describe TLS backend options and defaults.
clients/rust/crates/ahp-ws/Cargo.toml	Introduces TLS backend features and adjusts tokio-tungstenite/rustls dependencies accordingly.
clients/rust/CHANGELOG.md	Records the user-visible TLS backend selection change for the Rust crates.
clients/rust/Cargo.lock	Updates lockfile to include newly introduced TLS-related dependencies.

Copilot's findings

• Files reviewed: 5/6 changed files
• Comments generated: 2

[Copilot]

Copilot's findings

• Files reviewed: 5/6 changed files
• Comments generated: 1