crypto: harden IBM Z AES and ECDSA constant-time paths

[loadingalias]

Summary

• replace s390x AES key expansion and table-based fallback exposure with raw KM keys and the shared fixslice64 backend
• replace ECDSA wide reduction and Fermat inversion with fixed-work reduction and safegcd inversion
• make ct.toml the DudeCT gate authority and strengthen report validation, diagnostics, lifecycle evidence, benchmarks, and WASI vectors
• replace push profiles with one fast just push path that never compiles or runs test suites

Validation

• weekly-profile test-all: 1,758 tests and 227 doctests passed
• host, Windows, Linux, constrained, and s390x cross-check lanes passed after target-specific lint cleanup
• s390x CT artifact validation passed with zero hard or needs-fix findings; native IBM Z timing evidence remains intentionally pending
• WASI runtime vectors passed with default and SIMD configurations
• just check-actions passed, including actionlint and zizmor
• production just push completed end to end in 8.63 seconds

Follow-up evidence

The CT workflow is intentionally not run by this PR creation step. Native CT evidence will be run separately after the normal required CI suite is green.

[codecov]

Codecov Report

❌ Patch coverage is 96.10390% with 15 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/auth/ecdsa.rs	88.18%	15 Missing ⚠️

📢 Thoughts on this report? Let us know!