Explore optional FIPS build profile for AWS-LC backed crypto

## Context

As part of moving JWT and RS256 crypto away from RustCrypto `rsa`, we are adopting AWS-LC backed crypto paths. A follow-up decision is whether Registry Stack should support an optional FIPS build profile.

## Questions to answer

- Which binaries/crates would need FIPS-backed crypto in a supported deployment?
- Can `aws-lc-rs` be built with its `fips` feature across our release targets?
- What CI/release tooling would be required, including C/C++ compiler, CMake, Go, and bindgen/libclang where needed?
- Which AWS-LC-FIPS module version, NIST certificate, security policy, and supported operating environments would we rely on?
- What claims can we safely make, distinguishing "built with a FIPS module" from full application or deployment FIPS compliance?
- Should this be a separate release artifact/profile rather than the default build?

## Notes

Non-FIPS `aws-lc-rs` is the near-term target for replacing vulnerable RSA dependencies. This ticket is for a later compliance and release-engineering assessment, not a blocker for the current RSA vulnerability work.

No files, tests, or entry points are named. Start by inventorying the binaries, crates, release targets, and CI tooling covered by the repository, then assess aws-lc-rs FIPS build requirements and the referenced compiler, CMake, Go, bindgen, and libclang dependencies. Done means a documented module and environment assessment, safe compliance claims, and a recommendation for a separate profile or artifact.

Written by the indexing model from the issue text.