Problem

CSFLE and Queryable Encryption functional tests run only when CRYPT_SHARED_LIB_PATH is set (TestServer.SupportsEncryption). Evergreen sets it, via drivers-evergreen-tools (mongodl.py --component crypt_shared), as does the C# driver's CI. Local runs rely on a manually downloaded, version-pinned library (CONTRIBUTING.md pins 8.0.11). The recommended local mode (MONGODB_URI and ATLAS_URI unset, Atlas-local container) never sets it, so encryption tests skip silently and a local green run can hide encryption regressions, including in the native query path.

Plan

• Add tests/tools/fetch-crypt-shared.sh, which fetches crypt_shared with the same mongodl.py resolution CI uses and prints the export line.
• Emit a visible warning (not a failure) when encryption tests are skipped for lack of the library.
• Update CONTRIBUTING.md and AGENTS.md to use the script instead of manual downloads.
• Document what running with an empty CRYPT_SHARED_LIB_PATH exercises (the mongocryptd fallback).