Enable bounded bigmod operations by default

[mswilkison]

Depends on #11 and is stacked on constant-time-hardening-backport. This carries the public corrections from #10 onto the current backport and enables the covered bigmod operations by default, following upstream's public default-on change.

Selectively adapts public commits 3169e56d59bf022817dad838ca81e62b02dd08e9 and cf15377f96bf8f3d522c6de7a626f4a13e6e3649, and upstream 44a95b248096396b4ef8a611bed789948be46267.

Encode exponents at a fixed public width, including zero, reject overflow instead of silently widening the operation, and use explicit public bounds where proof exponents exceed the arithmetic modulus width. Snapshot the mode across multi-step operations. Decryption uses its existing Carmichael exponent for inversion, preserving support for keys without the optional PhiN field.

Coverage remains limited to the documented exponentiation paths: surrounding conversions, reductions, and other math/big operations remain variable-time. The explicit opt-out API remains available. Kept as a draft for application performance and rollout review.

Validation: focused default-mode, zero, width, inverse, mode-toggle, unequal-modulus, and nil-PhiN compatibility tests passed in common, crypto/paillier, and crypto/mta. Repository-wide go vet, formatting, diff checks, independent patch review, and correction verification passed. The repository-wide test run is in progress. Existing 2048-bit exponentiation benchmarks ran successfully; these are primitive measurements on one machine and do not establish application throughput or side-channel resistance.

Full test CI and formatting CI were dispatched for this branch because the automatic PR trigger only covers master.

[piotr-roslaniec]

Heads up — a separate review pass turned up one more CT gap that none of #8 / #10 / #11 / this PR cover: upstream bnb-chain/tss-lib's 3709c25 also hardens crypto/schnorr/schnorr_proof.go (witness multiplications in NewZKProofWithSession / NewZKVProofWithSession) and ecdsa/signing/round_3.go / round_4.go / round_5.go (k·γ, k·w, θ⁻¹, m·k, rx·σ). I cherry-picked the port onto a new stacked draft — #23 (ct-hardening-schnorr-signing-coverage, base codex/ct-defaults-and-bounds) — using the exact same IsConstantTimeEnabled() / NewCTModInt(...).MulCT / .ModInverseCT pattern. gofmt -l ., go build ./..., go vet ./..., and go test ./... all clean there; new Schnorr equivalence test (crypto/schnorr/constant_time_equiv_test.go) passes.

Separately, the same upstream commit also touches crypto/mta/share_protocol.go's AliceEnd / AliceEndWC — but via a different mechanism (sleep-based NewTimingProtection, ~200 ms + jitter) that doesn't exist in this fork and isn't a mechanical extension of the bigmod CT pattern. I deliberately did not port that, but I did add a COVERAGE comment in common/constant_time.go recording it as a known, intentionally-deferred gap so it doesn't get lost — see #23 for that doc update.