fix: refresh arm64e carry to openssl-src 300.6.1

[cypherair]

Summary

• merge the official openssl-src 300.6.1+3.6.3 release into the owned arm64e carry
• pin the OpenSSL submodule to reviewed carry merge e9038561371fe42b0cba8002d46be05f4f87906f, which contains official OpenSSL 3.6.3 plus the arm64e Poly1305 callback PAC fix
• preserve the owned-fork URL, carry branch, arm64e target mappings, and Apple SDK overrides
• disable unused OpenSSL applications for every tvOS wrapper target because libapps calls fork(), which the tvOS SDK prohibits
• add packaged-source stable aarch64 tvOS CI so the library-only configuration cannot regress
• refresh carry-chain status and the active Rust stable-1.97 branch reference

Layering and security

The tvOS correction is intentionally in src/lib.rs, not the OpenSSL arm64e target definitions: openssl-src only returns and installs libssl/libcrypto, while OpenSSL applications are unused wrapper build products. Passing no-apps avoids compiling unavailable app/server code without changing crypto APIs or weakening authentication. The failure also reproduces on the previous OpenSSL 3.6.2 carry, so it is not a 3.6.3 or PAC regression.

The submodule update imports OpenSSL 3.6.3 security fixes and retains the arm64e callback signing verified in cypherair/openssl#2.

Validation

• both downstream commits have valid CypherAir SSH signatures
• cargo +stable fmt --all -- --check
• cargo +stable test --all-targets
• git diff --check and shell syntax checks
• ci/check-arm64e-carry-chain.sh confirms the committed gitlink equals the current owned carry head
• exact-head clean-clone cargo +stable package --no-verify: 2,438 files, 31.9 MiB / 6.9 MiB compressed
• packaged aarch64 macOS testcrate: pass; OpenSSL_version_num() is 0x30600030
• packaged aarch64 macOS release packaging binary: pass
• new packaged stable aarch64-apple-tvos compile/link lane: pass
• authenticated Rust 1.97.0-dev / LLVM 22.1.6 stage1 compile+link: pass for arm64e-apple-darwin, arm64e-apple-ios, arm64e-apple-tvos, and arm64e-apple-visionos
• macOS arm64e packaging binary executes successfully
• file, lipo, and vtool confirm arm64e plus the expected macOS/iOS/tvOS/visionOS platform load commands
• packaged arm64e libcrypto.a is arm64e; its Poly1305 object contains paciza x12 and paciza x13

Follow-up

After this merges, CypherAir will advance its openssl-src lock to this carry merge commit and update Sequoia to 2.4.1 in the consumer PR.

[cypherair]

Final independent review: PASS — no actionable findings.

Reviewed exact range 679faca397f2014361895b545c6c4bb850d4e43e..b7de98f93e3d3e219a263672c25bb2f40222f83d. Provenance and ancestry are correct: the signed merge imports official wrapper release 64c38cc, both CypherAir commits have valid SSH signatures, and the gitlink is exactly owned OpenSSL carry merge e9038561371fe42b0cba8002d46be05f4f87906f. The reviewer verified .gitmodules, mappings, version, workflow, and docs are consistent.

The tvOS-wide no-apps fix is correctly scoped to Apple tvOS triples: it removes the prohibited unused libapps/fork() path while preserving build_libs, install_dev, libssl, and libcrypto. The new packaged-source CI has read-only permissions and introduces no secret or privilege exposure.

Cheap checks and exact-head clean-clone packaging passed; the package contains 2,438 files and .cargo_vcs_info.json pins b7de98f. The linked-worktree-only Cargo ENOENT was confirmed as local nested-submodule metadata residue and does not reproduce in the clean clone. No security, correctness, workflow, documentation, signature, or scope blocker was found.

[cypherair]

Merged into carry/apple-arm64e-openssl-fork with regular merge commit 1aea076d67ee701d3e9b9ad68177203881542868. The reviewed head was b7de98f93e3d3e219a263672c25bb2f40222f83d; independent review passed with no findings and the carry-chain workflow passed, including the new packaged tvOS build. Next, CypherAir will pin this merge commit and update Sequoia to 2.4.1.