Build 53: Windows + Android support with a per-platform Nym sidecar

Ship the bundled nym-socks5-client on Windows and Android, not just Linux:
- sidecar.rs resolves the binary per platform — nym-socks5-client.exe on
  Windows; on Android the sidecar rides in the APK jniLibs as
  libnym_socks5_client.so and is launched from the native-library dir (the
  one exec-allowed path), located via NATIVE_LIBS_DIR.
- Restore a vendored, statically-linked OpenSSL. Upstream Grim got this from
  arti's static feature; dropping arti for Nym took it with it, which broke
  Android/cross builds (no system OpenSSL for the target) and left desktop
  dynamically linked to libssl. Inert on Windows/macOS (SChannel/Security.fw).
- android.sh bundles the sidecar into jniLibs per ABI; scripts/nym-android.sh
  cross-builds it. Onboarding copy: Tor -> the Nym mixnet.

Verified end to end on an x86_64 emulator: the sidecar extracts, launches,
initialises, and opens the mixnet SOCKS5 proxy on 127.0.0.1:1080.

scripts/android.sh

@@ -48,6 +48,22 @@ function build_lib() {
 
   sed -i -e 's/"cdylib","rlib"]/"rlib"]/g' Cargo.toml
   rm -f Cargo.toml-e
+
+  # Bundle the Nym SOCKS5 sidecar beside libgrim.so. Named lib*.so so Android
+  # ships it in the APK's jniLibs and extracts it to the native-library dir —
+  # the only exec-allowed location for a child process (manifest needs
+  # extractNativeLibs=true). Built from the Nym workspace; see scripts/nym-android.sh.
+  [[ $1 == "v7" ]] && nym_target=armv7-linux-androideabi
+  [[ $1 == "v8" ]] && nym_target=aarch64-linux-android
+  [[ $1 == "x86" ]] && nym_target=x86_64-linux-android
+  nym_bin="${NYM_DIR:-../nym/target}/${nym_target}/release/nym-socks5-client"
+  if [ -f "${nym_bin}" ]; then
+    cp "${nym_bin}" "android/app/src/main/jniLibs/${arch}/libnym_socks5_client.so"
+    echo "bundled Nym sidecar: jniLibs/${arch}/libnym_socks5_client.so"
+  else
+    echo "WARN: Nym sidecar missing at ${nym_bin} — APK will have NO mixnet sidecar"
+    success=0
+  fi
 }
 
 ### Build application

scripts/nym-android.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+# Cross-compile the bundled Nym SOCKS5 sidecar (nym-socks5-client) for Android.
+# scripts/android.sh copies the result into the APK's jniLibs as
+# libnym_socks5_client.so so Goblin can launch the mixnet client on-device.
+#
+# Usage: NYM_SRC=../nym scripts/nym-android.sh [v7|v8|x86|all]
+#   NYM_SRC  path to the Nym workspace checkout (default: ../nym)
+# Requires: ANDROID_NDK_HOME, rustup android targets, cargo-ndk.
+#
+# Note: the sidecar is patched to use preconfigured webpki roots on Android
+# (common/http-api-client/src/registry.rs) — the default rustls platform
+# verifier needs the app's JNI context, which a standalone process lacks.
+set -e
+
+NYM_SRC="${NYM_SRC:-../nym}"
+WHICH="${1:-all}"
+
+build() {
+  local abi="$1"
+  echo ">> building nym-socks5-client for ${abi}"
+  ( cd "${NYM_SRC}" && cargo ndk -t "${abi}" build --release -p nym-socks5-client )
+}
+
+case "${WHICH}" in
+  v7)  build armeabi-v7a ;;
+  v8)  build arm64-v8a ;;
+  x86) build x86_64 ;;
+  all) build arm64-v8a; build x86_64; build armeabi-v7a ;;
+  *)   echo "usage: $0 [v7|v8|x86|all]"; exit 1 ;;
+esac
+echo "done — sidecars in ${NYM_SRC}/target/<triple>/release/nym-socks5-client"