feat: Refactor TLS and PSK support to use OpenSSL

.github/copilot-instructions.md

@@ -152,17 +152,13 @@ injects them during builds through `.github/steps/compute-versions` and
 
 ## Feature Flags and Platforms
 
-- The `psk` feature enables TLS 1.3 pre-shared key support through OpenSSL in
-  `tacacsrs-networking` and propagates through `tacon`, `tacacsrs-agent`, and
-  `tacacsrs-agentd`.
-- Default builds should remain pure Rust and avoid external OpenSSL requirements.
+- Default builds use dynamically linked OpenSSL for certificate-based TLS and
+  TLS 1.3 pre-shared key support.
 - Library features must be additive: enabling a feature may add capability, but
   must not remove or change unrelated public API behavior.
-- Use `#[cfg(feature = "psk")]` and platform `cfg`s narrowly around code that
-  truly needs them.
-- Windows CI may build release artifacts with `psk`; Linux GNU release artifacts
-  build the executable Debian packages with `psk` and package
-  `tacacsrs-bash-plugin` without additional feature flags.
+- Use platform `cfg`s narrowly around code that truly needs them.
+- Windows CI packages OpenSSL runtime DLLs with release artifacts; Linux GNU
+  release artifacts dynamically link against the system OpenSSL packages.
 - `session-wrapper` is Linux x86_64-specific. On Windows, validate it through WSL
   with paths mapped under `/mnt/<drive>/...`.
 

.github/steps/generate-sbom/README.md

@@ -27,7 +27,6 @@ Generates SBOM files to comply with supply chain security requirements, includin
     describe: binaries
     target: x86_64-pc-windows-msvc
     target-in-filename: 'true'
-    features: psk
 ```
 
 ## Inputs

.github/workflows/ci.yml

@@ -114,10 +114,10 @@ jobs:
       container-registry: ghcr.io/authscaffold
       products: |
         [
-          {"os": "ubuntu-latest", "target": "x86_64-unknown-linux-gnu", "asset_name": "tacon-linux-gnu-x86_64", "package_name": "tacon", "package_root": "executables/tacon", "artifact_name": "tacon", "artifact_kind": "bin", "features": "psk", "sbom_describe": "binaries", "man_page_name": "tacon", "debian_package": true},
-          {"os": "ubuntu-latest", "target": "x86_64-unknown-linux-gnu", "asset_name": "tacacsrs-agentd-linux-gnu-x86_64", "package_name": "tacacsrs-agentd", "package_root": "executables/tacacsrs_agentd", "artifact_name": "tacacsrs-agentd", "artifact_kind": "bin", "features": "psk", "sbom_describe": "binaries", "man_page_name": "tacacsrs-agentd", "debian_package": true},
+          {"os": "ubuntu-latest", "target": "x86_64-unknown-linux-gnu", "asset_name": "tacon-linux-gnu-x86_64", "package_name": "tacon", "package_root": "executables/tacon", "artifact_name": "tacon", "artifact_kind": "bin", "features": "", "sbom_describe": "binaries", "man_page_name": "tacon", "debian_package": true},
+          {"os": "ubuntu-latest", "target": "x86_64-unknown-linux-gnu", "asset_name": "tacacsrs-agentd-linux-gnu-x86_64", "package_name": "tacacsrs-agentd", "package_root": "executables/tacacsrs_agentd", "artifact_name": "tacacsrs-agentd", "artifact_kind": "bin", "features": "", "sbom_describe": "binaries", "man_page_name": "tacacsrs-agentd", "debian_package": true},
           {"os": "ubuntu-latest", "target": "x86_64-unknown-linux-gnu", "asset_name": "tacacsrs-bash-plugin-linux-gnu-x86_64", "package_name": "tacacsrs-bash-plugin", "package_root": "libraries/tacacsrs_bash_plugin", "artifact_name": "tacacsrs_bash_plugin", "artifact_kind": "cdylib", "features": "", "sbom_describe": "all-cargo-targets", "man_page_name": "", "debian_package": true},
-          {"os": "windows-latest", "target": "x86_64-pc-windows-msvc", "asset_name": "tacon-windows-msvc-x86_64", "package_name": "tacon", "package_root": "executables/tacon", "artifact_name": "tacon", "artifact_kind": "bin", "features": "psk", "sbom_describe": "binaries", "man_page_name": "tacon", "debian_package": false}
+          {"os": "windows-latest", "target": "x86_64-pc-windows-msvc", "asset_name": "tacon-windows-msvc-x86_64", "package_name": "tacon", "package_root": "executables/tacon", "artifact_name": "tacon", "artifact_kind": "bin", "features": "", "sbom_describe": "binaries", "man_page_name": "tacon", "debian_package": false}
         ]
       versions: ${{ needs.release-policy.outputs.skip-release == 'true' && '{}' || needs.compute-versions.outputs.versions || '{}' }}
     secrets: inherit

.github/workflows/pullrequest_workflow.yml

@@ -47,10 +47,10 @@ jobs:
       skip-audit-if-no-dep-changes: true
       products: |
         [
-          {"os": "ubuntu-latest", "target": "x86_64-unknown-linux-gnu", "asset_name": "tacon-linux-gnu-x86_64", "package_name": "tacon", "package_root": "executables/tacon", "artifact_name": "tacon", "artifact_kind": "bin", "features": "psk", "sbom_describe": "binaries", "man_page_name": "tacon", "debian_package": true},
-          {"os": "ubuntu-latest", "target": "x86_64-unknown-linux-gnu", "asset_name": "tacacsrs-agentd-linux-gnu-x86_64", "package_name": "tacacsrs-agentd", "package_root": "executables/tacacsrs_agentd", "artifact_name": "tacacsrs-agentd", "artifact_kind": "bin", "features": "psk", "sbom_describe": "binaries", "man_page_name": "tacacsrs-agentd", "debian_package": true},
+          {"os": "ubuntu-latest", "target": "x86_64-unknown-linux-gnu", "asset_name": "tacon-linux-gnu-x86_64", "package_name": "tacon", "package_root": "executables/tacon", "artifact_name": "tacon", "artifact_kind": "bin", "features": "", "sbom_describe": "binaries", "man_page_name": "tacon", "debian_package": true},
+          {"os": "ubuntu-latest", "target": "x86_64-unknown-linux-gnu", "asset_name": "tacacsrs-agentd-linux-gnu-x86_64", "package_name": "tacacsrs-agentd", "package_root": "executables/tacacsrs_agentd", "artifact_name": "tacacsrs-agentd", "artifact_kind": "bin", "features": "", "sbom_describe": "binaries", "man_page_name": "tacacsrs-agentd", "debian_package": true},
           {"os": "ubuntu-latest", "target": "x86_64-unknown-linux-gnu", "asset_name": "tacacsrs-bash-plugin-linux-gnu-x86_64", "package_name": "tacacsrs-bash-plugin", "package_root": "libraries/tacacsrs_bash_plugin", "artifact_name": "tacacsrs_bash_plugin", "artifact_kind": "cdylib", "features": "", "sbom_describe": "all-cargo-targets", "man_page_name": "", "debian_package": true},
-          {"os": "windows-latest", "target": "x86_64-pc-windows-msvc", "asset_name": "tacon-windows-msvc-x86_64", "package_name": "tacon", "package_root": "executables/tacon", "artifact_name": "tacon", "artifact_kind": "bin", "features": "psk", "sbom_describe": "binaries", "man_page_name": "tacon", "debian_package": false}
+          {"os": "windows-latest", "target": "x86_64-pc-windows-msvc", "asset_name": "tacon-windows-msvc-x86_64", "package_name": "tacon", "package_root": "executables/tacon", "artifact_name": "tacon", "artifact_kind": "bin", "features": "", "sbom_describe": "binaries", "man_page_name": "tacon", "debian_package": false}
         ]
       versions: ${{ needs.compute-versions.outputs.versions || '{}' }}
     secrets: inherit

.github/workflows/reusable-pipeline.yml

@@ -78,10 +78,10 @@ on:
         required: false
         default: |
           [
-            {"os": "ubuntu-latest", "target": "x86_64-unknown-linux-gnu", "asset_name": "tacon-linux-gnu-x86_64", "package_name": "tacon", "package_root": "executables/tacon", "artifact_name": "tacon", "artifact_kind": "bin", "features": "psk", "sbom_describe": "binaries", "man_page_name": "tacon", "debian_package": true},
-            {"os": "ubuntu-latest", "target": "x86_64-unknown-linux-gnu", "asset_name": "tacacsrs-agentd-linux-gnu-x86_64", "package_name": "tacacsrs-agentd", "package_root": "executables/tacacsrs_agentd", "artifact_name": "tacacsrs-agentd", "artifact_kind": "bin", "features": "psk", "sbom_describe": "binaries", "man_page_name": "tacacsrs-agentd", "debian_package": true},
+            {"os": "ubuntu-latest", "target": "x86_64-unknown-linux-gnu", "asset_name": "tacon-linux-gnu-x86_64", "package_name": "tacon", "package_root": "executables/tacon", "artifact_name": "tacon", "artifact_kind": "bin", "features": "", "sbom_describe": "binaries", "man_page_name": "tacon", "debian_package": true},
+            {"os": "ubuntu-latest", "target": "x86_64-unknown-linux-gnu", "asset_name": "tacacsrs-agentd-linux-gnu-x86_64", "package_name": "tacacsrs-agentd", "package_root": "executables/tacacsrs_agentd", "artifact_name": "tacacsrs-agentd", "artifact_kind": "bin", "features": "", "sbom_describe": "binaries", "man_page_name": "tacacsrs-agentd", "debian_package": true},
             {"os": "ubuntu-latest", "target": "x86_64-unknown-linux-gnu", "asset_name": "tacacsrs-bash-plugin-linux-gnu-x86_64", "package_name": "tacacsrs-bash-plugin", "package_root": "libraries/tacacsrs_bash_plugin", "artifact_name": "tacacsrs_bash_plugin", "artifact_kind": "cdylib", "features": "", "sbom_describe": "all-cargo-targets", "man_page_name": "", "debian_package": true},
-            {"os": "windows-latest", "target": "x86_64-pc-windows-msvc", "asset_name": "tacon-windows-msvc-x86_64", "package_name": "tacon", "package_root": "executables/tacon", "artifact_name": "tacon", "artifact_kind": "bin", "features": "psk", "sbom_describe": "binaries", "man_page_name": "tacon", "debian_package": false}
+            {"os": "windows-latest", "target": "x86_64-pc-windows-msvc", "asset_name": "tacon-windows-msvc-x86_64", "package_name": "tacon", "package_root": "executables/tacon", "artifact_name": "tacon", "artifact_kind": "bin", "features": "", "sbom_describe": "binaries", "man_page_name": "tacon", "debian_package": false}
           ]
         type: string
       versions:
@@ -369,7 +369,7 @@ jobs:
           target: ${{ matrix.config.target }}
 
       - name: Collect OpenSSL runtime DLLs
-        if: runner.os == 'Windows' && contains(matrix.config.features, 'psk')
+        if: runner.os == 'Windows'
         uses: ./.github/steps/collect-openssl-runtime
 
       - name: Package SBOMs