Retire the build policy that guarded a provider there no longer is

CI caught this and I did not, because I ran the test binary directly instead of
ctest -- and build_policy is a ctest, not a case inside mangos_tests. The suite
reported 191 passing while the twelfth test was never asked.

The rule required mangosd to leave through `return 1` when the OpenSSL provider
manager failed to initialise. That is a good rule for the reason it gives:
returning 0 tells a supervisor the process exited cleanly, so nothing restarts
it. It has simply run out of subject. RC4 was the only algorithm this tree ever
fetched from the legacy provider, it is implemented here now, and mangosd
performs no fallible crypto init at start-up at all -- SHA-1, SHA-256 and the
bignum work come from the default provider, which is inside libcrypto and
cannot be absent while libcrypto is present.

Deleted rather than loosened, and replaced by its own inverse: mangosd must not
mention OpenSSLProvider again. A policy that matches nothing is worse than no
policy, because it passes for the right reason today and for the wrong reason
the moment somebody reintroduces a start-up check and forgets its exit code.
This way, whoever brings a fallible crypto init back is told to bring the exit
rule with it.

12 of 12 ctest cases pass, which is how this should have been checked the first
time.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: 2 people

src/tests/CheckBuildPolicy.cmake

@@ -31,15 +31,24 @@ foreach(REQUIRED_TEXT
   endif()
 endforeach()
 
-# The provider manager is a Meyers singleton in mangos_two and an RAII local in
-# the other three cores. Either spelling is accepted; what is not negotiable is
-# that a failed crypto init leaves through `return 1`. Returning 0 tells a
-# supervisor the process exited cleanly, so nothing restarts it.
-string(REGEX MATCH
-  "if \\(![A-Za-z_:.()]*IsInitialized\\(\\)\\)[^\n]*[\r\n]+[^\n]*\\{[\r\n]+[^\n]*Log::WaitBeforeContinueIfNeed\\(\\);[\r\n]+[^\n]*return 1;"
-  PROVIDER_FAILURE "${MANGOSD_SOURCE}")
-if(NOT PROVIDER_FAILURE)
-  message(FATAL_ERROR "mangosd provider failure must return 1")
+# The provider clause is gone, with the provider it guarded.
+#
+# It required mangosd to leave through `return 1` when the OpenSSL provider manager
+# failed to initialise -- a good rule, because returning 0 tells a supervisor the
+# process exited cleanly and nothing restarts it. There is no longer anything for it to
+# describe: RC4 was the only algorithm this tree fetched from the legacy provider, it is
+# implemented in the tree now, and mangosd performs no fallible crypto init at start-up
+# at all. SHA-1, SHA-256 and the bignum work come from the default provider, which is
+# inside libcrypto and cannot be absent while libcrypto is present.
+#
+# Deleted rather than loosened. A policy that matches nothing is worse than no policy:
+# it passes for the right reason today and for the wrong reason the moment someone
+# reintroduces a start-up check and forgets its exit code.
+string(FIND "${MANGOSD_SOURCE}" "OpenSSLProvider" POSITION)
+if(NOT POSITION EQUAL -1)
+  message(FATAL_ERROR
+    "mangosd reaches for OpenSSLProvider again; if a fallible crypto init is back, so "
+    "must be the rule that it exits with 1")
 endif()
 
 string(FIND "${SRC_CMAKE}" "Upstream realmd passes the *file*" POSITION)