fix(build): scope x86_64 rustflags so aarch64 builds don't break

The .cargo/config.toml used [build] rustflags which applies globally
to every target. On aarch64-apple-darwin this injects
target-cpu=x86-64-v3 and +ssse3 as "ignored features", but the ring
crate's static CPU feature assertions detect the perturbed feature
set and fail to compile with:

    error[E0080]: evaluation panicked:
    assertion failed: CAPS_STATIC == MIN_STATIC_FEATURES
    at ring-0.17.14/src/cpu/arm/darwin.rs:51

Move the flags under [target.'cfg(target_arch = "x86_64")'] so only
x86_64 builds see them. ARM/Apple Silicon targets get their own AES
hardware path automatically via the aes crate's armv8 dispatch — no
explicit flags needed.

cc

.cargo/config.toml

@@ -1,4 +1,4 @@
-# Enable CPU intrinsics for AES-NI + SSSE3.
+# Enable CPU intrinsics for AES-NI + SSSE3 on x86_64 targets only.
 #
 # The qbz-cmaf crate does AES-128-CTR decrypt on every offline-cached
 # audio frame. Without AES-NI the decrypt falls back to a software
@@ -6,7 +6,7 @@
 # clears 400+ MB/s. For HiRes (200 MB+ tracks) this is the difference
 # between a 20-second gap and a sub-second one.
 #
-# Two things needed:
+# Two things needed on x86_64:
 # 1. `target-cpu=x86-64-v3` = Haswell microarchitecture baseline
 #    (2013+). Every CPU QBZ realistically runs on supports it. This
 #    gives AVX2, BMI2, etc. for general codegen.
@@ -15,8 +15,12 @@
 #    microarch level. Without this flag the `aes` crate's hardware
 #    dispatch never gets compiled in, no matter how capable the CPU.
 #
-# If we later ship prebuilt binaries for older CPUs we can switch to
-# a runtime-dispatch path, but for self-built and workstation-compiled
-# binaries this is the right default.
-[build]
+# IMPORTANT: these flags MUST be scoped to x86_64 targets. Using
+# `[build] rustflags = ...` applies them to every target, which on
+# aarch64-apple-darwin (and any other ARM target) corrupts the CPU
+# feature inference inside the `ring` crate and fails the build with
+# `assertion failed: CAPS_STATIC == MIN_STATIC_FEATURES`. ARM targets
+# get their own AES/crypto extensions automatically via `aes` crate's
+# armv8 path — we don't need to force anything there.
+[target.'cfg(target_arch = "x86_64")']
 rustflags = ["-C", "target-cpu=x86-64-v3", "-C", "target-feature=+aes,+ssse3"]