Fix Extended Validation OpenSSL/pkg-config setup on macOS runner

[pheidon]

Problem

Extended Validation is failing on the macOS/self-hosted runner after the recent merges to main because the Rust build cannot find OpenSSL/pkg-config for openssl-sys.

Latest observed failure:

• Workflow: Extended Validation
• Run: https://github.com/OMT-Global/apw-cli/actions/runs/25475002188
• Branch/title: main / Bound external fallback provider execution (#32)
• Failing job: Extended Checks → Run extended validation
• Host/target: aarch64-apple-darwin

Key log excerpt:

warning: openssl-sys@0.9.111: Could not find directory of OpenSSL installation
error: failed to run custom build command for `openssl-sys v0.9.111`
...
Could not run `PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1 pkg-config --libs --cflags openssl`
The pkg-config command could not be found.
Try `brew install pkgconf` if you have Homebrew.
...
$HOST = aarch64-apple-darwin
$TARGET = aarch64-apple-darwin
openssl-sys = 0.9.111

The gate then reports:

RESULTS: changes=success fast-checks=success extended-checks=failure validate-secrets=success
FAIL extended-checks => failure

Why it matters

Mainline CI is now red even though the normal Rust workflow is green. This can mask real regressions and blocks using Extended Validation as a reliable release/readiness signal.

Expected outcome

Make Extended Validation deterministic on the macOS runner by either:

• provisioning pkg-config/pkgconf and OpenSSL in the runner setup, and exporting the needed OPENSSL_DIR/PKG_CONFIG_PATH values when required; or
• changing the Rust dependency/build configuration so the extended check does not rely on ambient system OpenSSL discovery.

Acceptance criteria

• Extended Validation passes on main for the macOS/self-hosted runner.
• The workflow setup explicitly documents/provisions the OpenSSL/pkg-config requirement, or the dependency no longer needs system OpenSSL.
• A future clean runner failure gives a clear diagnostic instead of an opaque openssl-sys build-script failure.