Execute cryptography roadmap

[ZeroMarker]

What changed

• add standards-compatible SM2 ZA signatures and C1/C3/C2 encryption with the SM3 KDF
• add GB/T vectors plus OpenSSL signing and encryption interoperability coverage
• add SM4 CTR CLI support and make file input explicit with --file
• expand minimum-version CI and validate release tags against mix.exs
• document migration, security boundaries, benchmarks, streaming APIs, certificates, and SM9 scope

Why

The roadmap identified concrete SM2 compatibility and long-message confidentiality gaps, ambiguous CLI input behavior, and release validation gaps. This change implements the in-repository work while retaining explicit legacy SM2 entry points for migration.

Compatibility impact

A single positional CLI argument is now message text. File input must use --file. The behaviorless SM2 --hex option is removed. Legacy SM2 library APIs retain their existing formats.

Validation

• git diff --check
• GitHub workflow YAML parse
• full format, compile, tests, and OpenSSL interoperability run in CI

Local BEAM checks were unavailable because the Windows Erlang shim points to a removed runtime.

[ZeroMarker]

个人项目改为直接推送 main；此草稿 PR 不再使用。