chilldkg: CI wiring, ctime_tests coverage, declassify fixes

CI:
- ci/ci.sh: new CHILLDKG environment variable, passed to configure as
  --enable-module-chilldkg (mirroring FROST).
- .github/workflows/ci.yml: default CHILLDKG: 'no' and CHILLDKG: 'yes'
  in every job that enables FROST, except the x86_64 matrix entry that
  deliberately builds without the ecdh module (chilldkg requires
  schnorrsig + ecdh; the configure-time dependency error would fire
  there). YAML validity and per-job dependency presence checked
  programmatically.

ctime_tests:
- src/ctime_tests.c: run a full ChillDKG session (n = 2, t = 2) through
  the public API under the memory checker: hostpubkey_gen, params_hash,
  participant_step1, coordinator_step1, participant_step2,
  coordinator_finalize, participant_finalize, participant_recover and
  recovery_ack_sign. Host secret keys, session randomness, aux
  randomness and the resulting secret shares are undefined (secret);
  all protocol messages, the certificate, threshold public key, public
  shares, recovery data, ack signature and the secret-free state1
  objects are defined (public). state2 stays secret (contains the
  secret share).

Constant-time fixes found by running the new block under
MemorySanitizer (valgrind unavailable locally; MSan build via clang +
CMake). All are missing declassifications of secret-derived but public
(or public-outcome) values, following the frost module's
secp256k1_declassify pattern with justification comments; no real
constant-time bugs were found:
- hostpubkey_gen: declassify the computed host public key before
  serialization (public output).
- participant_step1: declassify the zero-randomness check result (only
  reveals "the RNG returned 32 zero bytes", which aborts the session).
- encpedpop participant_step1: declassify the pubnonce point before
  serialization (public, part of pmsg1).
- chilldkg_schnorrsig_sign: declassify the signer public key before
  normalization/parity branch, and declassify the return value (a
  failure only reveals a zero derived nonce, negligible probability).
- vss_commit: declassify the VSS commitments before serialization
  (public, part of pmsg1).
- vss_verify_secshare: declassify secshare*G before the infinity/eq
  checks (equals the public pubshare in honest runs; the discrete log
  is not revealed).
- simplpedpop_participant_investigate (proactive audit; not reached by
  ctime_tests): declassify the secshare-sum comparison result (the
  public fault code reveals it anyway).

Verified: MSan ctime_tests exits 0; autotools make check 10/10 (the
local tree is configured without --enable-ctime-tests because neither
valgrind nor an MSan-instrumented gcc build is available; CI runs
ctime_tests under valgrind as before); CMake ctest 428/428;
./tests --target=chilldkg and ./chilldkg_example pass.

ci/ci.sh

@@ -15,7 +15,7 @@ print_environment() {
             ECMULTWINDOW ECMULTGENKB ASM WIDEMUL WITH_VALGRIND EXTRAFLAGS \
             EXPERIMENTAL ECDH RECOVERY EXTRAKEYS SCHNORRSIG MUSIG SCHNORRSIG_HALFAGG ELLSWIFT \
             ECDSA_S2C GENERATOR RANGEPROOF SURJECTIONPROOF WHITELIST ECDSAADAPTOR BPPP \
-            FROST SECP256K1_TEST_ITERS BENCH SECP256K1_BENCH_ITERS CTIMETESTS SYMBOL_CHECK \
+            FROST CHILLDKG SECP256K1_TEST_ITERS BENCH SECP256K1_BENCH_ITERS CTIMETESTS SYMBOL_CHECK \
             EXAMPLES \
             HOST WRAPPER_CMD \
             CC CFLAGS CPPFLAGS AR NM \
@@ -70,6 +70,7 @@ fi
     --enable-module-musig="$MUSIG" \
     --enable-module-schnorrsig-halfagg="$SCHNORRSIG_HALFAGG" \
     --enable-module-frost="$FROST" \
+    --enable-module-chilldkg="$CHILLDKG" \
     --enable-examples="$EXAMPLES" \
     --enable-ctime-tests="$CTIMETESTS" \
     --with-valgrind="$WITH_VALGRIND" \