Move the pkcs11-provider prereq.sh check to a marker

enginepkcs11 also needs softhsm2, so its prereq.sh keeps that check
for now.

Assisted-by: Claude:claude-opus-4-8

bin/tests/system/enginepkcs11/prereq.sh

@@ -13,11 +13,6 @@
 
 . ../conf.sh
 
-[ "prereq/var/tmp/etc/openssl-provider.cnf" = "prereq${OPENSSL_CONF}" ] || {
-  echo_i "skip: pkcs11-provider not enabled"
-  exit 255
-}
-
 [ -n "${SOFTHSM2_CONF}" ] || {
   echo_i "skip: softhsm2 configuration not available"
   exit 255

bin/tests/system/enginepkcs11/tests_sh_enginepkcs11.py

@@ -11,7 +11,9 @@
 
 import pytest
 
-pytestmark = pytest.mark.extra_artifacts(
+import isctest.mark
+
+EXTRA_ARTIFACTS = pytest.mark.extra_artifacts(
     [
         "dig.out.*",
         "dsset-*",
@@ -48,6 +50,11 @@ pytestmark = pytest.mark.extra_artifacts(
     ]
 )
 
+pytestmark = [
+    isctest.mark.with_pkcs11_provider,
+    EXTRA_ARTIFACTS,
+]
+
 
 @pytest.mark.flaky(max_runs=5)  # GL#4605
 def test_enginepkcs11(run_tests_sh):

bin/tests/system/isctest/mark.py

@@ -150,6 +150,11 @@ softhsm2_environment = pytest.mark.skipif(
     reason="SOFTHSM2_CONF and SOFTHSM2_MODULE environmental variables must be set and pkcs11-tool and softhsm2-util tools present",
 )
 
+with_pkcs11_provider = pytest.mark.skipif(
+    os.path.basename(os.getenv("OPENSSL_CONF") or "") != "openssl-provider.cnf",
+    reason="pkcs11-provider not enabled",
+)
+
 
 def have_ipv6():
     sock = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)