[CI] Remove OpenSSL install added in #1937 when `cryptography` ships `win_arm64` wheels

[ndabas]

Context

#1937 added Windows ARM64 (win_arm64) wheel builds. cryptography is a base
dependency of autobahn and publishes no win_arm64 wheel, so pip builds it from
sdist on the windows-11-arm runner. That build links openssl-sys, which needs a
native ARM64 OpenSSL.

To unblock the ARM64 build we added a temporary bootstrap step in
.github/workflows/wheels.yml:

- name: Build OpenSSL for cryptography (Windows ARM64 only)
  if: matrix.os == 'windows-11-arm'
  shell: pwsh
  run: |
    vcpkg install --triplet arm64-windows-static-md --clean-after-build openssl
    "OPENSSL_DIR=$env:VCPKG_INSTALLATION_ROOT\installed\arm64-windows-static-md" |
      Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

This step exists only to work around the missing upstream wheel. It should be
deleted once upstream ships one again.

Upstream status

WoA support landed via pyca/cryptography#15350
and win_arm64 wheels were published — then dropped again:

cryptography	win_arm64 wheels
46.0.0 – 46.0.3	yes (cp38-abi3, cp311-abi3, cp314-cp314t)
46.0.4 – 50.0.1	no

Verified against the PyPI JSON API on 2026-09-22; latest release is 50.0.1 and still
has none.

Do NOT gate this on the version floor

pyproject.toml declares cryptography>=3.4.6. Tying removal to that floor — or to any
version bound — is unsound, because availability is not monotonic: 46.0.3 has the
wheel and 46.0.4+ do not. A >=46.0.0 floor would wrongly imply the bootstrap is
unnecessary.

The correct condition is about the resolved version at build time, not a declared
bound.

Exit criteria

Remove the step when the version that actually resolves on the ARM64 runner ships a
win_arm64 wheel:

pip index versions cryptography     # note the version that resolves
# then confirm a *-win_arm64.whl exists for it on PyPI

Work items

• Confirm the resolved cryptography ships a win_arm64 wheel
• Delete the Build OpenSSL for cryptography (Windows ARM64 only) step from wheels.yml
• Confirm the windows-11-arm job still passes (no OPENSSL_DIR, no vcpkg build)
• Check job duration — removing the vcpkg OpenSSL build should be a noticeable saving
• Remove the TODO comment block above the step

Related

See also #1935 (wheel tiers) — win_arm64 is best-effort, which is part of why this
workaround is acceptable in the interim.

[ndabas]

(Apologies for the 'enhancement' label -- it was either this or a 'bug' label.)