fix(oab-mcp): install rustls CryptoProvider before first TLS handshake (studio#119)

[brettchien]

Summary

Fixes the blocker in #119 (item 1 of the runbook) — the actual crash behind the New Fleet → Kubernetes wizard's namespace listing silently hanging for cert-based contexts (e.g. orbstack).

studio-cp pulls in both rustls crypto backends transitively: kube's rustls-tls feature → hyper-rustls defaults to ring; the AWS SDK crates (aws-sdk-sts etc.) default to aws-lc-rs. Nothing in the process installed a default, so the first real TLS handshake panics on a tokio-rt-worker thread:

Could not automatically determine the process-level CryptoProvider from Rustls crate features.
Call CryptoProvider::install_default() before this point...

Confirmed via cargo tree -e features -i ring / -i aws-lc-rs inside crates/studio-cp — both backends really are present in the resolved graph.

Why this showed up as two different symptoms (live-debugged with Brett via the Debug drawer's MCP log):

• GKE context (exec-based auth): fails before reaching TLS, at the exec-spawn step → clean synchronous error, visible in the Activity log.
• orbstack context (cert-based, no exec step): goes straight to the TLS handshake → hits the panic on a background tokio task → the list_namespaces JSON-RPC request never gets a response. Confirmed in the MCP debug log: request id:1053 with {"context":"orbstack"} has no matching result, unlike neighboring id:1052/1054/1055. Namespace field's datalist silently never populates.

Fix

Install aws-lc-rs as the process default in OabMcp::from_env() — the constructor shared by both the stdio binary (oab-mcp sidecar) and the in-process reverse-MCP tunnel driver, so both entry points are covered by one call site. Picked aws-lc-rs to match the backend the AWS SDK side of this same crate already uses. The install call's Result is discarded — install_default() can only succeed once per process, and if some other path already won that race, that's fine too, we only need a provider installed.

Verification

• Not locally compiled — this environment reliably OOM-kills on aws-sdk-ec2 transitively pulled into the workspace resolve regardless of which crate is targeted (cargo check -p oab-mcp -j 1 still OOMs on it), a known pre-existing limitation (same as fix(src-tauri): register missing Tauri command bridges for k8s onboarding tools (studio#104) #117/feat(deploy): wire k8s provider through New Fleet wizard submit (studio#104) #118's disclaimer, not something new here).
• API usage double-checked against rustls 0.23.43 docs: rustls::crypto::aws_lc_rs::default_provider() -> CryptoProvider, CryptoProvider::install_default(self) -> Result<(), Arc<Self>> — both signatures confirmed via docs.rs. Feature flag confirmed against rustls' own Cargo.toml (aws-lc-rs = ["aws_lc_rs"] alias, aws_lc_rs does not imply std so it's added explicitly).
• CI's build-test job is the real compile gate here.
• Recommend Brett re-test the New Fleet → Kubernetes → orbstack → namespace-listing path for real after this merges — same "can't verify in this environment" caveat as prior k8s PRs.

Ref #119.

🤖 Generated with Claude Code