Function pq_provider 

pub fn pq_provider() -> CryptoProvider

Build a CryptoProvider from the aws-lc-rs default provider with the X25519MLKEM768 hybrid kx group prepended to the kx group list. This is the per-config PQ support path (matching the FIPS pattern: fips_provider() returns a per-config provider). The server and client config builders use this when pq: true is set, passing the returned provider to ServerConfig::builder_with_provider or ClientConfig::builder_with_provider.

The classical X25519 group remains in the list as a fallback, so a client that does not support the hybrid group still completes a classical handshake.