feat: Linux/cloud platform stack (TLS, registry, static/cross, selfhost PM)

Ship the QUALITY_PLAN platform focus: thin/minimal runtime, --static/--target,
Nexus HTTPS/mTLS with graceful stop, lock checksums + install --locked,
selfhost registry (search/add/HTTP), containers, and CI smokes for cloud path.

lib/Net.bux

@@ -10,6 +10,16 @@ module Std::Net {
     extern func bux_socket_close(fd: int) -> int;
     extern func bux_socket_error() -> String;
 
+    // TLS server (OpenSSL) — opaque SSL_CTX* / SSL* as *void
+    extern func bux_tls_server_ctx(certPath: String, keyPath: String) -> *void;
+    extern func bux_tls_server_ctx_ex(certPath: String, keyPath: String, clientCaPath: String) -> *void;
+    extern func bux_tls_ctx_free(ctx: *void);
+    extern func bux_tls_accept(ctx: *void, fd: int) -> *void;
+    extern func bux_tls_send(ssl: *void, data: String, len: int) -> int;
+    extern func bux_tls_recv(ssl: *void, maxLen: int) -> String;
+    extern func bux_tls_close(ssl: *void);
+    extern func bux_tls_error() -> String;
+
     /* Create a TCP socket. Returns -1 on error. */
     func Net_Create() -> int {
         return bux_socket_create();
@@ -59,4 +69,42 @@ module Std::Net {
     func Net_LastError() -> String {
         return bux_socket_error();
     }
+
+    // ── TLS server (session 78) ──────────────────────────────────────────
+
+    /// Load PEM cert+key into a server SSL context. null on failure.
+    func Tls_ServerCtx(certPath: String, keyPath: String) -> *void {
+        return bux_tls_server_ctx(certPath, keyPath);
+    }
+
+    /// Server TLS + mTLS: require client certs signed by `clientCaPath` PEM.
+    func Tls_ServerCtxMtls(certPath: String, keyPath: String, clientCaPath: String) -> *void {
+        return bux_tls_server_ctx_ex(certPath, keyPath, clientCaPath);
+    }
+
+    func Tls_CtxFree(ctx: *void) {
+        bux_tls_ctx_free(ctx);
+    }
+
+    /// Handshake on an accepted TCP fd. Returns SSL handle or null.
+    func Tls_Accept(ctx: *void, fd: int) -> *void {
+        return bux_tls_accept(ctx, fd);
+    }
+
+    func Tls_Send(ssl: *void, data: String) -> int {
+        return bux_tls_send(ssl, data, bux_strlen(data) as int);
+    }
+
+    func Tls_Recv(ssl: *void, maxLen: int) -> String {
+        return bux_tls_recv(ssl, maxLen);
+    }
+
+    /// Free SSL handle only (caller still closes the TCP fd).
+    func Tls_Close(ssl: *void) {
+        bux_tls_close(ssl);
+    }
+
+    func Tls_LastError() -> String {
+        return bux_tls_error();
+    }
 }

lib/Os.bux

@@ -7,6 +7,9 @@ module Std::Os {
     extern func bux_getcwd() -> String;
     extern func bux_chdir(path: String) -> int;
     extern func bux_exit(code: int);
+    extern func bux_install_stop_handlers();
+    extern func bux_should_stop() -> int;
+    extern func bux_set_stop_listen_fd(fd: int);
 
     func Os_ArgsCount() -> int {
         return bux_argc();
@@ -37,4 +40,20 @@ module Std::Os {
         bux_exit(code);
     }
 
+    /// Install SIGINT/SIGTERM handlers that set a cooperative stop flag
+    /// (and close the listen fd if registered via Os_SetStopListenFd).
+    func Os_InstallStopHandlers() {
+        bux_install_stop_handlers();
+    }
+
+    /// True after SIGINT/SIGTERM (or if handlers not installed: always false).
+    func Os_ShouldStop() -> bool {
+        return bux_should_stop() != 0;
+    }
+
+    /// Register the server listen fd so stop signals can unblock accept().
+    func Os_SetStopListenFd(fd: int) {
+        bux_set_stop_listen_fd(fd);
+    }
+
 }