Bump qp-rusty-crystals dilithium/hdwallet to 4.1.1

[n13]

Bumps qp-rusty-crystals-dilithium and qp-rusty-crystals-hdwallet from 4.1.0 to 4.1.1 (Cargo.toml + lockfile; no other crates touched).

dilithium 4.1.1 fixes a signature-forgery vulnerability: the malicious-key guard only rejected an all-zero t1, but any key whose coefficients keep HighBits(c·2^D·t1) at zero accepted forged signatures (z = 0, empty hint) for every message with no secret key. 4.1.1 rejects the whole degenerate family; honest keys are unaffected. hdwallet 4.1.1 is the companion release raising its dilithium floor to ^4.1.1.

Cooldown-bypass-reason: dilithium 4.1.1 fixes a signature-forgery vulnerability (degenerate t1 public keys accepted forged signatures); first-party crates published by our own CI today, waiting 30 days would leave the vulnerable 4.1.0 pinned.

Note for the cooldown gate: apply the dependency-cooldown-bypass label (the label needs to be created in this repo first) — the check re-runs on labeling and reads the reason line above.

[n13]

Reviewer model: GPT Sol

Verdict (advisory): Approve

No blocking findings.

The manifest and lockfile resolve both qp-rusty-crystals-dilithium and qp-rusty-crystals-hdwallet to 4.1.1. I inspected the published source delta: dilithium applies the shared degenerate-t1 rejection predicate in verification, public-key parsing, and secret-key import, with regressions for ML-DSA-44/65/87; hdwallet 4.1.1 raises its dilithium requirement to 4.1.1. A targeted Cargo 1.93 update from the recorded base reproduced this PR's lockfile exactly.

Validation:

• git diff --check and locked Cargo metadata passed.
• Chain's qp-dilithium-crypto all-feature suite passed (23 tests), as did strict all-target Clippy.
• The exact upstream release workspace passed the dilithium all-feature suite (164 tests), the hdwallet suite (62 unit tests plus integration/zeroization tests), and strict all-target Clippy.
• All current PR checks pass: format, Linux and macOS check/test matrices, Clippy/docs, and the dependency-cooldown gate.

The unpacked crates.io dilithium package cannot run its own unit tests in isolation because test-only vectors outside the crate were not included in the package. This does not affect downstream builds; the corresponding exact release-workspace tests above cover the shipped source.