chapulin 0.2.0

chapulin 0.2.0 moves a host build's speed choices from build flags to the caller. On arm64 and x86-64, a web PKI client and both server roles now build one object that holds every fast path beside the portable code, and each session picks among them from ch_cfg.cpu, the caller's description of its CPU. A device build runs the portable code and has no such field.

• Breaking, ch_cfg.cpu: in a host build every init call and ch_srv_check return CH_EINVAL unless cpu holds CH_CPU_PROBED, and for a bit the object's architecture does not define. chapulin still probes nothing: the caller probes the CPU and owns PSTATE.DIT and DOITM.
• The bits: CH_CPU_CONSTANT_TIME_AES runs AES-GCM and QUIC's Initial packets on the AES and carry-less multiply instructions; without it a session offers ChaCha20 alone. CH_CPU_CONSTANT_TIME_MULTIPLY runs the native multiply, the vector Poly1305 and the 51-bit X25519 field. On x86-64, CH_CPU_AVX2 runs the AVX2 ChaCha20, and CH_CPU_VAES beside the AES bit runs the VAES AES-GCM.
• Removed: AES=hw, AES=runtime, ch_cfg.aes_instructions, CH_NATIVE_AES, WIDEMUL=runtime, ch_cfg.widemul, and the X25519 and CHACHA variables. A host build takes no AES or WIDEMUL value. A device build keeps AES=soft or extern and WIDEMUL=decomposed or native.
• To upgrade a host caller: drop those variables from the build and set cfg.cpu = CH_CPU_PROBED plus the bits your probe found. In Zig, set .cpu = .{ .constant_time_aes = ..., .constant_time_multiply = ... } on Client and Server. CH_CPU_AVX2 also states that the operating system saves the 256-bit registers, which a probe reads from CPUID and XGETBV.
• Speed: the server side of a handshake with x25519 and an ECDSA P-256 certificate takes 7.06 M instructions on arm64 with the multiply bit, against 42.30 M without it. On an x86-64 CI runner the VAES kernels seal a 16 KiB AES-128-GCM record in 3.3 to 3.6 µs, against about 6 µs on AES-NI. A forged 16 KiB AES-GCM record is refused in 2.5 µs, down from 8.3. docs/performance.md has the tables.
• Fixes: on x86-64 under Apple clang the vector Poly1305 left powers of its one-time key in stack slots the compiler picked; it now reads them from the one struct it wipes. The emulated Cortex-M3 test builds again, and CI fails where it used to skip that test.
• Stability: in 0.x the API and the build variables may change between minor versions. Breaking commits carry ! in the log.