MariaDB 11 client TLS breaks Drush/--defaults-file (ERROR 2026)

Problem

MariaDB 11.x clients (common in PHP 8.4 appserver images) require TLS by default. Local Lando DB services usually have no TLS, so CLI tools fail with:

ERROR 2026 (HY000): TLS/SSL error: SSL is required, but the server does not support it

scripts/mariadb-compat-install.sh already writes /etc/mysql/conf.d/lando.cnf with disable-ssl-verify-server-cert, which fixes interactive mysql/mariadb and PHP PDO/mysqli. It does not help tools that pass --defaults-file (notably Drush sql:* / site:install), because that flag ignores other client config files.

Reproduced on Pantheon recipe + PHP 8.4 + MariaDB 10.6 server; lando drush site-install fails on drop/create while plain mariadb without --defaults-file works. Related meta: lando/lando#3833.

Proposed fix

Extend MariaDB compat install with PATH argv wrappers for mariadb/mariadb-* that append --skip-ssl-verify-server-cert when the client supports that flag (gate on client capability, not server version). Rebuild-only; no Landofile or per-project Drush config required.

Workaround (until fixed)

Per-project drush.yml:

command:
  sql:
    '*':
      options:
        extra: '--skip-ssl-verify-server-cert'

Or DRUSH_COMMAND_SITE_INSTALL_OPTIONS_EXTRA=--skip-ssl-verify-server-cert for site-install only.

Start with scripts/mariadb-compat-install.sh and trace how its /etc/mysql/conf.d/lando.cnf is installed and how PATH commands are selected. Verify the wrapper only adds the option when the mariadb client supports it, then reproduce plain-client and --defaults-file/Drush-style invocations against a non-TLS MariaDB service.