refactor(crypto): route new host proxy tests through facade

Signed-off-by: Varsha Prasad Narsing <varshaprasad96@gmail.com>

Author: varshaprasad96

Cargo.lock

@@ -36,6 +36,7 @@ openshell-supervisor-network = { path = "../openshell-supervisor-network" }
 windows = { workspace = true }
 
 [dev-dependencies]
+openshell-crypto = { path = "../openshell-crypto" }
 tokio = { workspace = true }
 # tempfile is not a workspace dependency; 3.27 is already resolved in Cargo.lock.
 tempfile = "3"
@@ -47,7 +48,6 @@ openshell-policy = { path = "../openshell-policy" }
 # base64 and serde_json are already [dependencies] but dev-dependency resolution
 # is independent; explicit entries make them visible to integration tests.
 base64 = { workspace = true }
-rustls = { workspace = true }
 serde_json = { workspace = true }
 # Used by the drift guard test (handled_fields_inventory) to parse YAML into a
 # generic serde_json::Value for key enumeration.

crates/openshell-driver-mxc/Cargo.toml

@@ -767,7 +767,7 @@ async fn pc_https_egress_reads_injected_ca_bundle() {
         ..Default::default()
     };
 
-    let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
+    openshell_crypto::tls::ensure_default_provider();
     let config = MxcComputeConfig {
         wxc_exec_path: wxc.to_string_lossy().into_owned(),
         egress_proxy: true,

crates/openshell-driver-mxc/tests/wxc_exec_real.rs

@@ -294,7 +294,7 @@ mod tests {
 
     #[tokio::test]
     async fn starts_loopback_proxy_and_serves_policy_local() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
+        openshell_crypto::tls::ensure_default_provider();
         let binary = tempfile::NamedTempFile::new().unwrap();
         std::fs::write(binary.path(), b"agent").unwrap();