feat: Linux/cloud platform stack (TLS, registry, static/cross, selfhost PM)

Ship the QUALITY_PLAN platform focus: thin/minimal runtime, --static/--target,
Nexus HTTPS/mTLS with graceful stop, lock checksums + install --locked,
selfhost registry (search/add/HTTP), containers, and CI smokes for cloud path.

rt/runtime_win.c

@@ -471,6 +471,10 @@ int bux_chdir(const char* path) {
 }
 
 /* ── Time ─────────────────────────────────────────────────────────────── */
+void bux_install_stop_handlers(void) {}
+int bux_should_stop(void) { return 0; }
+void bux_set_stop_listen_fd(int fd) { (void)fd; }
+
 int64_t bux_time_ms(void) {
 #if BUX_IS_WIN
     FILETIME ft;
@@ -576,6 +580,24 @@ BuxString bux_socket_recv(int fd, int max_len) {
 int bux_socket_close(int fd) { (void)fd; return -1; }
 const char* bux_socket_error(void) { return "sockets not available on this platform"; }
 
+void* bux_tls_server_ctx_ex(const char* cert, const char* key, const char* ca) {
+    (void)cert; (void)key; (void)ca; return NULL;
+}
+void* bux_tls_server_ctx(const char* cert, const char* key) {
+    return bux_tls_server_ctx_ex(cert, key, NULL);
+}
+void bux_tls_ctx_free(void* ctx) { (void)ctx; }
+void* bux_tls_accept(void* ctx, int fd) { (void)ctx; (void)fd; return NULL; }
+int bux_tls_send(void* ssl, const char* data, int len) {
+    (void)ssl; (void)data; (void)len; return -1;
+}
+BuxString bux_tls_recv(void* ssl, int max_len) {
+    (void)ssl; (void)max_len;
+    BuxString s; s.data = NULL; s.len = 0; return s;
+}
+void bux_tls_close(void* ssl) { (void)ssl; }
+const char* bux_tls_error(void) { return "tls not available on this platform"; }
+
 /* ── Crypto — stubs (no OpenSSL) ──────────────────────────────────────── */
 static void zero_out(unsigned char* out, int n) {
     if (out && n > 0) memset(out, 0, (size_t)n);