v0.16.0

Critical UB fix: - MPIBINOP, mpi-mod, and mpi-mod-add all read result while in scope but uninitialized on every error path. Closed by declaring `Value result = SIGILFALSE;` at function top across all three.

Doc/behavior accuracy: - mpi-sub: documented as unsigned absolute-value (mbedtlsmpiwrite_binary writes magnitude and discards sign on the underlying MPI). Pointer to mpi-mod-add for callers needing modular wraparound. - mpi-shift-l: documented as returning #f on overflow (NOT silent truncation, which the doc previously claimed). Return type updated to (any-of bytevector? boolean?).

Hardening: - mpi-shift-l, mpi-shift-r reject negative bits/size with a typed error rather than underflowing to a huge size_t. - Constant-time warning at the head of the mpi- doc block: these primitives are not constant-time; do not apply directly to secret scalars. For ECDSA/ECDH on P-256 prefer the existing ecdsa-p256- primitives.

Breaking change: - sigil dep is now ^0.15.0 (was ^0.14). Consumers must be on sigil v0.15.0 or later.

Tests: - New: mpi-sub absolute-value semantics, mpi-shift-l overflow → #f, mpi-shift-l negative-arg → error.

PR: https://codeberg.org/sigil/sigil-crypto/pulls/1