fix(linux): qualify private Classic QUIC TLS toolchain

[zoeyrose]

Summary

Classic's accepted QUIC connections need the public SSL_get_peer_addr API, introduced in OpenSSL 4. The current Linux images supply OpenSSL 3.5, so they cannot qualify a connection-specific peer-address implementation.

Implementation / behavior

Add a private /opt/atrinik/tls cohort with checksum-pinned OpenSSL 4.0.3 and libcurl 8.22.0, shared by the broad and slim Linux toolchains. The prefix includes providers, configuration, discovery metadata and upstream licenses. Consumers explicitly opt in through ATRINIK_CLASSIC_TLS_PREFIX; distro TLS libraries, Python and system tools retain their existing configuration. Windows MXE and the sealed portable producer remain independent.

The installer bounds and validates source archives, runs the upstream QUIC API suite, and installs a matched libcurl with HTTP/HTTPS, IDN and zlib. The image smoke checks loaded provider paths, the public peer API, real trusted HTTPS and rejection of an untrusted certificate. Optional SSH, LDAP, GSSAPI, PSL, HTTP/2, HTTP/3, Brotli and Zstd support remains disabled in this application-only curl cohort.

Validation

• 26 Python installer/toolchain tests passed, including unsafe archives and manifest rejection.
• docker build --check, actionlint and git diff --check passed.
• Built both pinned sources as UID 1000 in the cached immutable Linux build image, with network disabled and bounded CPU/memory. The upstream 75-test_quicapi.t suite passed.
• Non-root provider/API and trusted/untrusted HTTPS smoke passed. ELF inspection confirms libcurl uses the prefix's OpenSSL 4 libraries and recorded runtime search paths.
• Upstream source signatures were verified against the published OpenSSL and curl signing keys before qualification.

Limitations / follow-up

Full broad/slim image builds and their existing consumer checks remain pending CI. This change supplies the TLS toolchain; the corresponding Classic peer-address fix must separately pass real concurrent-peer authorization and native suites. No image publication, deployment or live server changes were performed.

Superseded

The owner requested that the application neither collect nor track player IP addresses. The peer-address getter and its associated IP-based checks are being removed. The remaining Classic QUIC and access-token APIs are available in the existing OpenSSL 3.5 toolchain, so this OpenSSL 4 upgrade is unnecessary. Local updater administration already uses a Unix socket with OS peer credentials. This draft is closed without merging or publishing an image.