Bump qp-rusty-crystals dilithium/hdwallet to 4.1.1

[n13]

Bumps qp-rusty-crystals-dilithium and qp-rusty-crystals-hdwallet from 4.1.0 to 4.1.1 (Cargo.toml + lockfile; no other crates touched).

dilithium 4.1.1 fixes a signature-forgery vulnerability: the malicious-key guard only rejected an all-zero t1, but any key whose coefficients keep HighBits(c·2^D·t1) at zero accepted forged signatures for every message with no secret key. 4.1.1 rejects the whole degenerate family; honest keys are unaffected. hdwallet 4.1.1 raises its dilithium floor to ^4.1.1.

Cooldown-bypass-reason: dilithium 4.1.1 fixes a signature-forgery vulnerability (degenerate t1 public keys accepted forged signatures); first-party crates published by our own CI, waiting 30 days leaves the vulnerable 4.1.0 pinned.

[n13]

Reviewer model: GPT Sol

Verdict (advisory): Approve

No blocking findings.

The manifest and lockfile consistently move both qp-rusty-crystals-dilithium and qp-rusty-crystals-hdwallet to 4.1.1. The locked graph resolves one 4.1.1 copy of each, including qp-dilithium-crypto's transitive path, and the published crate checksums match Cargo.lock. I also checked the released source: the dilithium update expands the malicious-key guard beyond all-zero t1 at public-key parsing, secret-key import, and verification, while hdwallet raises its dilithium requirement to 4.1.1. The unrelated-looking windows-sys/cfg-if lock references are compatible resolver deduplications; the exact locked graph builds and tests successfully.

Validation:

• git diff --check 6245cd0...cb90a44, pinned nightly cargo fmt --all -- --check, and locked metadata resolution passed.
• cargo test --locked: 301 library and 299 binary tests passed; one doctest remained intentionally ignored.
• SKIP_CIRCUIT_BUILD=1 cargo clippy --all-targets --locked -- -D warnings passed.
• The three upstream non-zero degenerate-t1 forgery regressions passed for ML-DSA-44, ML-DSA-65, and ML-DSA-87 from the source commit recorded in the published 4.1.1 crate.
• All eight exact-head GitHub checks are green, including Ubuntu/macOS build-and-test, Clippy/docs, security audit, examples, formatting, and dependency cooldown. Local cargo audit was unavailable because cargo-audit is not installed, so I relied on the successful hosted audit for that check.