aead: implement nonce-based AES-SIV-CMAC-256

[loadingalias]

Summary

• implement the registered AES-SIV-CMAC-256 nonce-based AEAD profile from RFC 5297 with typed 32-byte keys and borrowed non-empty variable-length nonces
• keep the public profile narrow: one RFC 5116 AAD string plus a distinct nonce, with no deterministic SIV, raw CMAC/S2V, raw AES, or protocol-specific API
• reuse the existing portable and native AES-128 authorities, including batched AES-NI/VAES, AES-CE, POWER, s390x, and RISC-V paths, without adding a product dependency
• return opaque authentication failures and clear the complete rejected plaintext; bind the new secret owners and operations into CT, zeroization, fuzz, WASI, benchmark, and release evidence

Security and performance boundaries

The implementation follows the RFC key split, S2V component ordering, synthetic-IV counter-bit clearing, full 128-bit counter increment, and synthetic_iv || ciphertext layout. Repeated complete key/nonce/AAD/plaintext tuples reveal equality, so nonce uniqueness remains the normal caller contract even though authenticity survives reuse.

Context construction precomputes the AES schedules and CMAC subkeys. CMAC selects the AES backend once per block stream, and CTR encrypts independent counter blocks in native batches. In-place seal/open operations allocate no memory; alloc-enabled RISC-V context construction retains the existing boxed fixslice schedule.

Focused validation

• host and x86_64 Rust 1.98 Clippy across the combined and isolated owning feature sets
• 218 focused library tests plus RFC 5297 vectors and 256 generated differential cases against RustCrypto
• every tag-byte corruption and representative ciphertext/AAD/nonce corruption rejects opaquely and clears plaintext
• allocation, redaction, Serde, doctest, and focused fuzz-corpus replay checks
• just ct-validate --target aarch64-apple-darwin --manifest-only
• just check-zeroize-evidence
• env SSH_AUTH_SOCK=... just check-actions
• scripts/ci/nostd-wasm-suite.sh wasm32-wasip1 shallow
• combined AEAD benchmark target compilation