auth: accept caller entropy for RSA signing

[loadingalias]

Summary

• add caller-supplied entropy APIs for RSA profile and TLS signing without adding dependencies
• replace private variable-time inversion with a fixed-schedule batched blinding inverse and preserve bounded blinding, CRT fault checks, cleanup, and allocation-free scratch reuse
• make Cargo Rail the compiler-result cache authority, pin the current Rust/WASM tooling, and explicitly defer SemVer enforcement while the crate is pre-1.0
• preserve provenance in the AArch64 CRC alignment path required by the current toolchain

Release intent

• includes .changes/add-caller-random-rsa-signing-a1e7.md as a minor release entry
• tooling, CI policy, and internal provenance repairs do not add user-facing release fragments

Evidence

• just check
• just check-actions
• just test --all — 1,725 unit/integration tests and 212 doctests passed; one environment-specific test skipped
• Apple AArch64 RSA assembly tests
• optimized constant-time leakage validation, including the modular inverse candidate
• just ct-validate
• just check-zeroize-evidence
• WASI shallow runtime suite with Rust 1.98.0, Wasmtime 48.0.0, and wasm-tools 1.257.1, including SIMD
• RSA leaf build without default features
• exact repaired leaf gate: cargo test --locked --no-default-features --features rsa --lib --no-run

The full pre-push matrix was not repeated after the final one-line leaf-feature gate repair; the exact configuration that exposed it passed before publication.