fix(tls): honor Go key exchange defaults across transports

Remove the eight explicit curve overrides so Go 1.27 honors tlsmlkem=0
across Server listeners, node links and outbound transports. Remove the
unused shared curve option and add wire-level regression coverage.

Document CA trust and TLS upgrade behavior, retain the investigation
artifacts, and exclude their synthetic routes from the rebrand guard.
The product compatibility baseline remains unchanged.

Validation: focused race tests, HTTP tests, lint, compatibility guard
positive/negative controls, and a fresh Linux build with three isolated
OIDC integration scenarios all pass.

Adversarial review: Claude Code Fable 5.1, max effort.
Final verdict: APPROVE FOR COMMIT.

Signed-off-by: Feng Ruohang <rh@vonng.com>

internal/config/etcd/etcd.go

@@ -166,7 +166,6 @@ func LookupConfig(kvs config.KVS, rootCAs *x509.CertPool) (Config, error) {
 			NextProtos:               []string{"http/1.1", "h2"},
 			ClientSessionCache:       tls.NewLRUClientSessionCache(64),
 			CipherSuites:             crypto.TLSCiphersBackwardCompatible(),
-			CurvePreferences:         crypto.TLSCurveIDs(),
 		}
 		// This is only to support client side certificate authentication
 		// https://coreos.com/etcd/docs/latest/op-guide/security.html

internal/crypto/crypto.go

@@ -70,9 +70,3 @@ func TLSCiphersBackwardCompatible() []uint16 {
 		tls.TLS_RSA_WITH_AES_256_CBC_SHA,
 	}
 }
-
-// TLSCurveIDs returns a list of supported elliptic curve IDs
-// in preference order.
-func TLSCurveIDs() []tls.CurveID {
-	return []tls.CurveID{tls.X25519MLKEM768, tls.CurveP256, tls.X25519, tls.CurveP384, tls.CurveP521}
-}

internal/http/transports.go

@@ -46,9 +46,8 @@ type ConnSettings struct {
 	DialTimeout time.Duration
 
 	// TLS Settings
-	RootCAs          *x509.CertPool
-	CipherSuites     []uint16
-	CurvePreferences []tls.CurveID
+	RootCAs      *x509.CertPool
+	CipherSuites []uint16
 
 	// HTTP2
 	EnableHTTP2 bool
@@ -70,7 +69,6 @@ func (s ConnSettings) getDefaultTransport(maxIdleConnsPerHost int) *http.Transpo
 	tlsClientConfig := tls.Config{
 		RootCAs:            s.RootCAs,
 		CipherSuites:       s.CipherSuites,
-		CurvePreferences:   s.CurvePreferences,
 		ClientSessionCache: tls.NewLRUClientSessionCache(tlsClientSessionCacheSize),
 	}