fix(ci): vendor openssl for macos cross checks

Cargo.lock

@@ -3071,6 +3071,15 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
+[[package]]
+name = "openssl-src"
+version = "300.6.0+3.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8e8cbfd3a4a8c8f089147fd7aaa33cf8c7450c4d09f8f80698a0cf093abeff4"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "openssl-sys"
 version = "0.9.116"
@@ -3079,6 +3088,7 @@ checksum = "f28a22dc7140cda5f096e5e7724a6962ca81a7f8bfd2979f9b18c11af56318c4"
 dependencies = [
  "cc",
  "libc",
+ "openssl-src",
  "pkg-config",
  "vcpkg",
 ]

crates/op-git/Cargo.toml

@@ -14,8 +14,9 @@ description = "Git-backed version control for OpenPencil documents"
 [dependencies]
 # In-process libgit2. `vendored-libgit2` builds + statically links
 # libgit2 from source (cmake + cc), so the shipped binary carries its
-# own git engine. Keeps the default `https` / `ssh` transports.
-git2 = { version = "=0.20.4", features = ["vendored-libgit2"] }
+# own git engine. `vendored-openssl` keeps cross-arch macOS checks from
+# depending on a runner-local OpenSSL installation for the target arch.
+git2 = { version = "=0.20.4", features = ["vendored-libgit2", "vendored-openssl"] }
 thiserror = { workspace = true }
 # Credential store (`auth.rs`) persistence — the host-keyed token /
 # SSH-key table is serialized to a JSON file.