fix(buzz-pair): install rustls ring CryptoProvider before WSS (#7998)

## Summary

- `buzz-pair` panics on any `wss://` relay (including the documented
default `wss://relay.damus.io`) because no rustls `CryptoProvider` is
installed. `ws://` is unaffected.
- Sibling binaries already install ring explicitly
(`crates/buzz-cli/src/lib.rs`) and take a direct `rustls` dep with the
`ring` feature so a unified release build can still select a provider.
- This applies the same two-line pattern to `buzz-pairing-cli`: direct
`rustls` dep (`ring` + `std`) and `install_default()` at the top of
`main()`, before any connection.

Fixes #7927.

## Test plan

- [x] Diff matches the established `buzz-cli` install pattern (same dep
features, same `let _ =` swallow on double-install).
- [x] `cargo build -p buzz-pairing-cli` and `buzz-pair source --relay
wss://relay.damus.io` reaches "Waiting for target" without the rustls
panic.
- [x] `buzz-pair test-vectors` still exits 0 (no WSS, install is a
no-op).

---------

Signed-off-by: Bartok9 <259807879+Bartok9@users.noreply.github.com>

Cargo.lock

@@ -1346,6 +1346,7 @@ dependencies = [
  "futures-util",
  "hex",
  "nostr 0.44.7",
+ "rustls",
  "serde_json",
  "thiserror 2.0.18",
  "tokio",

crates/buzz-pairing-cli/Cargo.toml

@@ -23,3 +23,10 @@ hex = { workspace = true }
 clap = { version = "4", features = ["derive", "env"] }
 thiserror = { workspace = true }
 zeroize = { workspace = true }
+
+# Explicit rustls dep with ring provider — required to install the process-level
+# CryptoProvider at startup. Without this, `buzz-pair` panics on any `wss://`
+# relay (including the default `wss://relay.damus.io`) when a multi-package
+# release build unifies both ring and aws-lc-rs features. See crates/buzz-cli.
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
+

crates/buzz-pairing-cli/src/main.rs

@@ -96,6 +96,14 @@ enum CliError {
 
 #[tokio::main]
 async fn main() {
+    // Install ring as the process-level rustls CryptoProvider before any WSS
+    // connection. The documented default relay is `wss://relay.damus.io`, and a
+    // multi-package release build unifies both ring and aws-lc-rs across the
+    // workspace, so rustls cannot auto-select a provider. Without this,
+    // `buzz-pair source` panics at rustls crypto/mod.rs after printing the QR.
+    // The `let _ =` swallow is intentional: a second install returns Err.
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
     let cli = Cli::parse();
     if let Err(e) = run(cli.command).await {
         eprintln!("error: {e}");