use OnceLock;
/// Install `ring` as the process-wide `rustls` default crypto backend, once.
/// `reqwest` with `rustls-no-provider` panics on client construction without
/// an installed backend, so this runs before every client is created. Only
/// errors when another backend already owns the default, which cannot happen
/// from our own code paths.