Fixes the Linux Python wheel build that broke the `0.9.3` release (and would
have broken `0.9.4`), and adds a CI guard so it cannot regress silently.
### Root cause
The `live-binance` data layer links `native-tls` -> `openssl-sys`, which needs
OpenSSL at build time. Neither wheel container provides it:
- **manylinux** ships no OpenSSL headers, and
- **musllinux** cross-compiles against a musl sysroot that has no OpenSSL at all,
so installing a host package (`yum`/`apk`) cannot reach the cross target.
The 3-OS Python CI jobs build natively on the runner, which already has system
OpenSSL, so CI stayed green while the release container build failed.
### Fix
- New opt-in **`vendored-tls`** feature on `wickra-data` and the Python binding:
enables `native-tls/vendored`, compiling OpenSSL from source and linking it
statically. No system OpenSSL needed on either libc. No-op on macOS/Windows
(Security.framework / SChannel — `openssl-sys` is never in the graph there).
- `release.yml` builds the Linux wheels with `--features vendored-tls` (replaces
the manylinux-only `before-script-linux` header install, which could not fix
the musllinux cross build).
- CI gains a **`manylinux` + `musllinux` container build-smoke** matrix job, so
both container builds run on every PR. This PR's own CI is the proof the fix
works before any release re-attempt.
### Notes
- No version bump: `0.9.4` published nowhere (the release run was cancelled
before any publish job ran), so this lands on `0.9.4` and the tag is re-pointed
at the fixed commit.
- Adds checks to `ci.yml` (the smoke job is now a 2-entry matrix).
kingchenc
41d5a7dd25