fix(ci): declare the reqwest edge remote-ssh-concrete now needs

Core boundary check failed: services-integrations keeps every optional runtime
dependency owned by an explicit integration feature, and one-click relay deploy
started using reqwest to fetch the signed release checksum without registering
that edge.

Declared rather than worked around. The alternative was to move the fetch into
the desktop crate (its only caller) and pass hashes into start_task, but that
puts security-critical verification in an API-surface file, away from the
contract it protects, and leaks the env-var naming out of the module that
consumes it. aes-gcm and rand already list remote-ssh-concrete as an owner in
this same rule, so this is the registration path the file establishes, not an
exception invented for this change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: bobleer

scripts/core-boundaries/rules/feature-rules.mjs

@@ -94,7 +94,10 @@ export const optionalDependencyFeatureOwnerRules = [
       { depName: 'oxc', ownerFeatures: ['canvas-runtime'] },
       { depName: 'qrcode', ownerFeatures: ['remote-connect'] },
       { depName: 'rand', ownerFeatures: ['mcp', 'remote-connect', 'remote-ssh-concrete'] },
-      { depName: 'reqwest', ownerFeatures: ['announcement', 'browser-control', 'debug-log', 'mcp', 'miniapp-runtime', 'remote-connect', 'review-platform', 'speech', 'web-tools'] },
+      // remote-ssh-concrete: one-click relay deploy fetches the signed release
+      // checksum over HTTPS and verifies it on this device, because the target
+      // server has no minisign and no trust root of its own.
+      { depName: 'reqwest', ownerFeatures: ['announcement', 'browser-control', 'debug-log', 'mcp', 'miniapp-runtime', 'remote-connect', 'remote-ssh-concrete', 'review-platform', 'speech', 'web-tools'] },
       { depName: 'rmcp', ownerFeatures: ['mcp'] },
       { depName: 'russh', ownerFeatures: ['remote-ssh-concrete'] },
       { depName: 'russh-keys', ownerFeatures: ['remote-ssh-concrete'] },