docs: correct signing timing assumptions and class-D rationale

[lannbot]

Decision

Keep Ed25519 signing exported and ECDSA signing withheld, but state the basis accurately: ECDSA's exclusion is conservative provider policy pending signing-path assurance, not an inherent inability to implement constant-time ECDSA or a measured safety difference from Ed25519.

Replace the incorrect absence-of-secret-nonce and algorithm-level constant-time claims across the WIT docs, provider policy, and Rust comments. RFC 8032 derives a secret per-message nonce deterministically; determinism removes the fresh-randomness requirement, not leakage risk. Record compiler/runtime assumptions and the lack of an Ed25519 signing timing-lab probe. Correct the adjacent cfg-versus-dependency/DCE explanation.

The pinned P-256 scalar inversion uses a fixed public exponent; P-384 uses fixed-iteration divstep. Source inspection supports constant-time-designed arithmetic, not an end-to-end timing guarantee. No generated-code assurance is claimed.

Documentation/comments only. No executable code, WIT signatures, exports, dependencies, or conformance expectations change. CBC timing policy is a separate change.

Verification

• just fmt-check
• just validate-wit
• cargo check -p polymorph-webcrypto-core -p polymorph-webcrypto-guest-provider
• git diff --check
• Independent documentation review; no blocking findings.

Automerge will be armed and CI watched.

Fixes #404