Update atuin to 18.19.0 (#582)

* Update atuin to 18.19.0

* atuin: 18.19.0 needs openssl — new native-tls dependency, build AND runtime

The bot's bump builds on neither arch:

    Could not find openssl via pkg-config: The pkg-config command could not
    be found.  ...  openssl-sys = 0.9.117

Not a packaging error. Upstream added a native-TLS path — verified by diffing
the two lockfiles:

    18.17.1   openssl-sys 0   native-tls 0
    18.19.0   openssl-sys 1   native-tls 1   (+11 tls-feature refs)

`reqwest` 0.13.4 takes its default-tls feature, and `sqlx-core` /
`tokio-tungstenite` pull `native-tls` as well, so it is wired through the graph
rather than being one flag to flip. 18.17.1 resolved TLS in pure Rust and needed
no system library at all, which is why the package never declared one.

Follows the `codex` precedent exactly (rust + toolchain + pkgconf + openssl, no
env vars needed).

## The half that would have shipped broken

Adding the BUILD deps made it compile — and `missing runtime_deps` then failed:

    executable dependency 'libcrypto.so.3' not in runtime deps, needed by usr/bin/atuin
    executable dependency 'libssl.so.3' not in runtime deps, needed by usr/bin/atuin

native-tls links openssl DYNAMICALLY, so it is a runtime dependency too. Without
it the package builds clean, checks green on everything else, and the shipped
binary cannot start. The checker is the only thing between those two states.

Third bump today whose build INPUTS changed rather than just its version
(happy's happy-lib split, grafana dropping grafana-server, now this). A version
check cannot see any of them; only a build can.

Built and checked on both: 15/15 Pass.

---------

Co-authored-by: gominimal-pkgmgr-mgr[bot] <285843623+gominimal-pkgmgr-mgr[bot]@users.noreply.github.com>
Co-authored-by: bryan <bryan@minimal.dev>

Author: gominimal-pkgmgr-mgr[bot]

packages/atuin/build.ncl

@@ -2,29 +2,45 @@ let { subsetOf, Attrs, BuildSpec, Local, OutputBin, Source, .. } = import "minim
 let base = import "../base/build.ncl" in
 let rust = import "../rust/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
+# atuin 18.19.0 pulls native-tls: reqwest 0.13.4 takes its default-tls
+# feature, and sqlx-core / tokio-tungstenite pull it too, so openssl-sys
+# 0.9.117 now has to find a system OpenSSL via pkg-config. 18.17.1 had
+# NEITHER crate in its Cargo.lock (0 -> 1 for both, verified against the two
+# lockfiles), which is why this bump broke a build that had been fine.
+let pkgconf = import "../pkgconf/build.ncl" in
+let openssl = import "../openssl/build.ncl" in
 
 let gcc = import "../gcc/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "18.17.1" in
+let version = "18.19.0" in
 {
   name = "atuin",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/atuinsh/atuin/v%{version}.tar.gz",
-      sha256 = "851c3f4870e4bd181b98d2dae60b9fd76ef30f05f16a85efa21ac7e7cf294862",
+      sha256 = "fdb8268cdd5b13105db79e821f06c1c6624e0c5aee46befb0491e39af42fd4e6",
       extract = true,
       strip_prefix = "atuin-%{version}",
     } | Source,
     base,
     rust,
     toolchain,
+    pkgconf,
+    openssl,
   ],
 
   runtime_deps = [
     glibc,
     subsetOf gcc ["libgcc"],
+    # The native-tls switch makes this a RUNTIME dep too, not just a build
+    # one: the binary dynamically links libssl.so.3 + libcrypto.so.3.
+    # The native-tls switch makes openssl a RUNTIME dep too, not just a build
+    # one: the binary dynamically links libssl.so.3 + libcrypto.so.3. The
+    # `missing runtime_deps` checker caught it — without this the package
+    # builds clean and the shipped binary cannot start.
+    openssl,
   ],
 
   cmd = "./build.sh",