gate sdk-pqc-bc runtime dep behind non-fips profile

Author: sujankota

cmdline/pom.xml

@@ -77,15 +77,27 @@
             <artifactId>sdk</artifactId>
             <version>${project.version}</version>
         </dependency>
-        <!-- Pulls the BouncyCastle KemProvider onto the classpath at runtime
-             so cmdline supports hybrid PQC (X-Wing, ECDH+ML-KEM). Discovered
-             via ServiceLoader; cmdline has no compile-time reference to BC.
-             FIPS deployments should omit this dep. -->
-        <dependency>
-            <groupId>io.opentdf.platform</groupId>
-            <artifactId>sdk-pqc-bc</artifactId>
-            <version>${project.version}</version>
-            <scope>runtime</scope>
-        </dependency>
     </dependencies>
+
+    <profiles>
+        <!-- Pulls the BouncyCastle KemProvider onto the classpath at runtime so
+             cmdline supports hybrid PQC (X-Wing, ECDH+ML-KEM). Gated behind
+             non-fips to mirror the reactor gating in the root pom: a fips
+             build does NOT include sdk-pqc-bc, so cmdline must not declare
+             a hard dep on it under fips either. -->
+        <profile>
+            <id>non-fips</id>
+            <activation>
+                <activeByDefault>true</activeByDefault>
+            </activation>
+            <dependencies>
+                <dependency>
+                    <groupId>io.opentdf.platform</groupId>
+                    <artifactId>sdk-pqc-bc</artifactId>
+                    <version>${project.version}</version>
+                    <scope>runtime</scope>
+                </dependency>
+            </dependencies>
+        </profile>
+    </profiles>
 </project>