Confirming ML-KEM handshakes in AL3 and AL4

[Copilot]

Removes the flag. As for .py change:

 Without  -trace , the successful handshake reports no group, so the old parser returns  None . With the PR command:

$ openssl s_client -trace -connect 127.0.0.1:4433 -groups X25519MLKEM768
extension_type=key_share(51), length=1124
    NamedGroup: UNKNOWN (4588)
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384

Can go when fully migrated to AL4 tho, it seems to detect correctly there.

[Copilot]

Pull request overview

This PR removes the TEST_HYBRID_TLS_GROUPS gating flag and makes the hybrid ML‑KEM TLS group negotiation checks run by default, updating the openssl s_client output parsing so hybrid groups can be identified reliably on Azure Linux 3 (OpenSSL 3.3) as well as Azure Linux 4.

Changes:

• Always run the hybrid TLS group unit test and the tls_groups_test e2e test (removing the CMake option and CI flag wiring).
• Update tests/tls_groups.py to run openssl s_client with -trace and map OpenSSL 3.3 “UNKNOWN (id)” NamedGroup IDs back to expected group names.
• Add tls_groups_test to CI bucket routing and remove the now-unused CI flag in AL4 workflow.

Custom instructions used:

• .github/copilot-instructions.md
• .github/instructions/reviewing.instructions.md

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/tls_groups.py	Parses openssl s_client -trace output and maps NamedGroup IDs to names to validate hybrid negotiation on OpenSSL 3.3/3.5.
tests/ci-buckets.txt	Ensures tls_groups_test is scheduled in bucket_a.
src/tls/test/main.cpp	Removes skip gate so hybrid group negotiation unit test always runs.
CMakeLists.txt	Removes TEST_HYBRID_TLS_GROUPS option and always registers tls_groups_test.
.github/workflows/ci-al4.yml	Drops -DTEST_HYBRID_TLS_GROUPS=ON from AL4 CI configuration.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.