docs: complete changelog and README for the dev integration

[piotr-roslaniec]

Documentation review of everything on dev (tracked in #37).

Changelog

• Composing PR list now covers every merged PR (fix(crypto): rebase and verify constant-time hardening backport onto current master #11-Bound random sampling domains and Paillier challenge widths #15, Check the protobuf generator version before regeneration #18, Update Go crypto dependencies and align the Go toolchain #20, Upgrade btcd and migrate to btcec/v2 #21, ci: run checks on every pull request, not just those targeting master #24, docs(changelog): record integration follow-ups #35 were missing) and states that feat(crypto): opt-in constant-time path for secret-exponent modexps [DO NOT MERGE] #8 and fix(crypto): handle CT exponent bounds, zero values, and toggle changes #10 were closed unmerged.
• New entries for Guard decoder lengths and nullable input fields #12-Bound random sampling domains and Paillier challenge widths #15 (decoder, lifecycle and sampling guards) and Update Go crypto dependencies and align the Go toolchain #20/Upgrade btcd and migrate to btcec/v2 #21 (dependency upgrades).
• New breaking changes: 10 tss.S256() concrete curve type (Upgrade btcd and migrate to btcec/v2 #21), 11 keygen decoders return errors (fix(crypto): complete input-bound hardening #28), 12 Go 1.25.7 minimum (Update Go crypto dependencies and align the Go toolchain #20). The compile-break summary listed only PrepareForSigning; it now also lists feat(signing)!: deliver signature results by pointer #39 and fix(crypto): complete input-bound hardening #28 and moves after the last breaking change.
• AliceEnd/AliceEndWC gap corrected: the decryption exponentiation is constant-time; the residual is surrounding math/big arithmetic and no response-time normalization.
• Breaking change 8 now gives measured end-to-end cost (Paillier Decrypt ~2.1x; 10-member keep-core signing ~1.3x), not only microbenchmarks.
• Paillier cache entry describes the current public-key cache; private-key state is not cached (fix(paillier): stop caching private-key decryption state; review follow-ups #38).
• Added section lists the new exported API (protocol mode, legacy MtA verifiers, CT helpers, modulus policy, Paillier sentinel errors).

Exported API changes were checked by diffing go doc -all signatures between master and dev.

README

• Release test commands: keygen was in the -count=20 set (about 4 hours); it now runs once in the full suite, and the mixed-binary harness is listed.
• Keygen example declares endCh.
• Security audit section states the 2019 audit predates this fork's changes.

Docs only; no code changes.