Test ML-KEM against C2SP CCTV and Wycheproof, plus a differential test #12

ACVP mostly covers the happy path. These sets cover the nasty edge cases.

• C2SP CCTV ML-KEM: the modulus-check negatives, the "unlucky" vectors that need lots of XOF reads, and the accumulated vectors
• Wycheproof ML-KEM files
• A dev-only differential test that compares our outputs with another implementation on random inputs
• Same rule as Test ML-KEM against the NIST ACVP vectors #11: the vector files are downloaded at test time through the manifest, never committed

Done when: all three run in CI and pass.

Depends on: #10. Plan: WP-4.

Part of #3.