v0.16.0

Critical UB fix:

• MPI_BINOP, mpi-mod, and mpi-mod-add all read result while in scope but uninitialized on every error path. Closed by declaring Value result = SIGIL_FALSE; at function top across all three.

Doc/behavior accuracy:

• mpi-sub: documented as unsigned absolute-value (mbedtls_mpi_write_binary writes magnitude and discards sign on the underlying MPI). Pointer to mpi-mod-add for callers needing modular wraparound.
• mpi-shift-l: documented as returning #f on overflow (NOT silent truncation, which the doc previously claimed). Return type updated to (any-of bytevector? boolean?).

Hardening:

• mpi-shift-l, mpi-shift-r reject negative bits/size with a typed error rather than underflowing to a huge size_t.
• Constant-time warning at the head of the mpi- doc block: these primitives are not constant-time; do not apply directly to secret scalars. For ECDSA/ECDH on P-256 prefer the existing ecdsa-p256- primitives.

Breaking change:

• sigil dep is now ^0.15.0 (was ^0.14). Consumers must be on sigil v0.15.0 or later.

Tests:

• New: mpi-sub absolute-value semantics, mpi-shift-l overflow → #f, mpi-shift-l negative-arg → error.

PR: https://codeberg.org/sigil/sigil-crypto/pulls/1