Timing checks: assembly scan and a dynamic timing test #16

Part of the security gate for 2.0. KyberSlash and CVE-2024-37880 both came from the compiler, not from the source code, so reading Rust isn't enough. We need to check what actually gets built.

• A script that builds release binaries for x86_64 and aarch64 (plus a spot check on 32-bit x86 and armv7, since we ship those) and looks for division instructions and secret-dependent branches in decaps, compress, poly_tomsg, poly_frommsg and the compare/select code
• A dynamic test (dudect-style, or valgrind with secrets marked undefined, like ctgrind) on decaps with valid vs. invalid ciphertexts
• Run it on both the new ML-KEM code and the legacy code. Findings in legacy code go into separate issues under Security pass over the legacy Kyber code #18
• Write the results up in SECURITY.md

Done when: the scripts run in CI (or as a documented manual step before each release) and the ML-KEM code passes.

Depends on: #10. Plan: WP-8.

Part of #3.