Rightsize ci runners - #112

Remove deprecated ECDSA and unbounded PBKDF2 wrappers, stale CRC diagnostics, and migration scaffolding while preserving active protocol support. Keep proof operations behind the internal compiler boundary and retain independent interoperability coverage.

Align evidence harnesses and CI runner configuration with the cleaned surface. Consolidate v0.10 release intent, refresh documentation, and include standalone workspace lockfiles in release preparation.

Audit the compiler-derived public API inventory on every release-evidence target. The boundary cleanup adds no entries and removes only the retired or internalized APIs, so record the resulting common snapshot.

Merge the default-branch profile publication into the rightsizing branch while retaining the reviewed downsized catalog. This restores a conflict-free pull-request merge commit for Actions.

Run repository shell wrappers through Bash on Windows so Python does not invoke them as Win32 executables.\n\nOn AArch64, make the GCM-SIV timing probe exercise the fused production derivation path and balance class ordering against short-lived host drift.

Probe every catalog-selected Cargo tool and retain standard downloadable artifacts. Balance ML-KEM timing classes and remove the multiply-based diagnostic sink so DudeCT measures the production kernel it names.