fix(linux): install libssl-dev so erlang builds with crypto and ssl - #105

Adds libssl-dev to linux_apt_packages, overturning a recorded decision that
said it was deliberately absent.

Why

The mise-managed Erlang 28.3 on the Linux host has no crypto application at
all. erl -eval 'crypto:strong_rand_bytes(4)' raises undef, and the install's
lib/ holds 32 app dirs with no crypto and no ssl among them.

The cause is confirmed from the kerl build log rather than inferred
(~/.cache/mise/erlang/kerl/builds/28.3/otp_build_28.3.log):

[packages] Probe failed for libssl-dev (distro: ubuntu): ... returned 1
checking for OpenSSL crypto library with version >= 0.9.8c in standard locations... no
configure: WARNING: No (usable) OpenSSL found, skipping ssl, ssh and crypto applications

Two details worth pulling out of that:

• It skips three applications, not two. ssh goes too.
• It is a WARNING, so the build then reports success. mise installs a
  working-looking erlang and the breakage surfaces only at first use. This is
  the same silent-skip failure mode the surrounding comment block already warns
  about for ruby extensions built under --with-ext=...,+.

libssl3t64 (the runtime) was already installed; only the headers were missing
— the same runtime-vs-headers split that bit libyaml and is documented two
lines above.

The decision this overturns

The comment previously read:

libssl-dev is deliberately absent: mise's ruby-build downloads and builds its
own OpenSSL into the ruby prefix, so ruby does not need the system one.

That is still true of ruby. It was the wrong thing to generalise from:
ruby-build vendors OpenSSL, erlang's configure does not. An absence justified
by one toolchain silently broke another. The rewritten comment records the
superseded reasoning rather than dropping it, matching how the Vulkan and Steam
blocks in the same file handle their own reversals.

Scope note — this does not fix the host by itself

The headers matter only at build time, so the existing erlang install is
unaffected by this change. After it lands, the host still needs:

mise run linux
mise uninstall erlang@28.3
mise install erlang@28.3
erl -noshell -eval 'io:format("~p~n",[crypto:strong_rand_bytes(4)]),halt().'

The last line should print a binary rather than undef.

Side effect, stated rather than buried

With libssl-dev present, a future mise install ruby may link the system
OpenSSL instead of vendoring its own — ruby-build prefers the system copy when
it is recent enough. Existing ruby installs are untouched. This is arguably the
better outcome by this file's own stated logic ("apt packages are patched by
unattended-upgrades, mise-managed ones are not"), but it is a behaviour change,
not a no-op.

Also in this PR

specs/_observations/entries/2026-08-06-erlang-no-crypto-b558b441.md is
updated: its "likely cause" is promoted to confirmed with the quoted configure
output, the missed third application (ssh) is added, the serving-side
consequence (a Phoenix or Cowboy endpoint cannot terminate HTTPS without ssl)
is folded in alongside the fetching-side one it already had, and the rebuild
command is recorded.

Verification

yamllint, gitleaks, syntax-check and ansible-lint all pass via the
pre-commit hooks. The package list parses to 51 entries with no duplicates and
no collision with linux_apt_packages_absent. The diff was checked to confirm
it removes nothing from #104's stale-declaration corrections to this same file.

Not verified here: that the rebuilt erlang actually gains crypto. That needs
the host convergence run, and is the first thing to check afterwards.