chore(deps): Properly pass selected TLS implementation to reqwest

[mjameswh]

What changed

• Dedup incompatible dependency on reqwest. temporalio-common was requiring 0.12, while temporalio-sdk-core and opentelemetry-otlp require 0.13, so any build enabling otel compiled two incompatible versions of reqwest.
• Properly pass the selected TLS implementation to reqwest when used for OTEL, Ephemeral Server download, and DebugClient. Those were previously depending on aws-lc-rs despite the tls-ring feature, resulting in both ring AND aws-lc-rs being built and linked into the resulting binary. Under tls-ring, ring is now installed as the process-wide default rustls CryptoProvider on first use, via the new temporalio_common::telemetry::ensure_default_crypto_provider().

Two reqwest clients end up with no compiled-in provider and resolve one from the process default at connection time: the ephemeral server downloader and the OTLP HTTP metric exporter. Both now call the new temporalio_common::telemetry::ensure_default_crypto_provider() before use. It is idempotent, is a no-op unless built with tls-ring and without tls-aws-lc, and tolerates another component having installed a provider first.

Verification

Verified with cargo tree --target all: no aws-lc-rs under tls-ring, no ring under tls-aws-lc, and a single reqwest. Full CI green, including the Docker integ (OTLP) tests.

cargo tree -p temporalio-sdk-core --features ephemeral-server,otel --target all, before:

aws-lc-rs v1.17.3
reqwest   v0.12.28
reqwest   v0.13.4

after:

reqwest   v0.13.4

• cargo check -p temporalio-sdk-core --test integ_tests --features temporalio-common/serde_serialize,test-utilities,ephemeral-server,otel
• Dependency graph compared before/after with cargo tree --target all, as above.

[Copilot]

Pull request overview

Switches reqwest TLS to ring by default, reducing native build and cross-compilation overhead.

Changes:

• Installs ring as the process-wide rustls provider.
• Updates ephemeral downloads and OTLP metrics initialization.
• Removes the duplicate reqwest dependency.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
crates/sdk-core/src/ephemeral_server/mod.rs	Initializes the TLS provider before downloads.
crates/sdk-core/Cargo.toml	Reconfigures reqwest TLS features.
crates/common/src/telemetry/otel.rs	Initializes TLS before exporter construction.
crates/common/src/telemetry.rs	Adds provider initialization helper.
crates/common/Cargo.toml	Removes reqwest 0.12 and adds rustls ring support.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (1)

crates/sdk-core/Cargo.toml:24

• ephemeral-server no longer guarantees a TLS-capable client when default features are disabled. --no-default-features --features ephemeral-server now activates reqwest without either TLS feature, while EphemeralExe::CachedDownload always contacts https://temporal.download and the new provider helper is a no-op in this configuration, so every cache miss fails. Please either make this feature combination select a TLS provider or explicitly reject the unsupported combination at compile time.

  "reqwest?/rustls-no-provider",