crypto: make caller-controlled boundaries explicit

[loadingalias]

Summary

• validate borrowed BLAKE2 keys once and return typed errors for variable-output misuse
• keep normal AEAD sealing responsible for nonce issuance while placing caller-nonce operations and platform overrides behind explicit expert namespaces
• remove panicking entropy constructors and root-level diagnostic or dangerous exports
• update affected benchmarks, fuzz and constant-time harnesses, migration guidance, tests, and minor release intent

Performance

The change adds no dependencies, allocations, dynamic dispatch, or new cryptographic indirection. Successful BLAKE2 hot-path code generation remains materially unchanged. The representative AEAD measurement changed by +0.10% with p = .76, so no performance change was detected.

Validation

• just check
• just test-all — 1,673 tests passed, 1 skipped; 218 doctests passed
• just test-feature-matrix — 38/38 profiles passed
• just check-all --skip-feature-matrix rscrypto
• official BLAKE2 vectors and portable/backend differential tests
• changed fuzz-package and constant-time tool builds
• just push
• git diff --check