docs: record CBC unpadding timing-policy exception

[lannbot]

Decision

Keep CBC exported for fixed-format compatibility and explicitly record its variable-time PKCS#7 unpadding as an exception to the provider's constant-time-variant policy. Class C describes the fixsliced AES core, not end-to-end CBC padding validation.

Replace the incorrect branch-free-unpadding and timing-bounded-by-error claims in the provider README and core comment. Clarify the consumer-facing WIT contract: returned errors are uniform, but that does not guarantee uniform execution timing. The residual risk applies to both CBC decryption and key unwrapping; AES-GCM remains the recommendation where the format is not fixed.

This resolves the documentation/policy contradiction left by #336, not the underlying variable-time behavior. No claim of measured remote exploitability or a timing fix. Documentation/comments only: no implementation, signatures, exports, dependencies, or test expectations change.

Verification

• Inspected the pinned block-padding 0.3.3 validator and the core's CBC decrypt path.
• just fmt-check
• just validate-wit
• git diff --check

Automerge will be armed and CI watched.

Fixes #405