[HackTuah]

Adds BeamMCP.Signer.MLDSA87, an ML-DSA-87 (FIPS 204) signer behind core's unchanged BeamMCP.Signer behaviour. It signs pure ML-DSA-87 through the external interface with an empty context, the form RFC 9964 requires for COSE (algorithm -50). BeamMCP.Signer.Ed25519 is unchanged.

The module

• Two keys per call: the 32-byte seed (:private_key) and its 2,592-byte public key (:public_key), each as bytes or a zero-arity function. The public key is required because :crypto signs from a seed but cannot derive the public key from one.
• Checked before it is returned: the signature must verify under the given public key, and must not verify over the bytes with one bit flipped. Otherwise it answers {:error, {:public_key, :does_not_verify}} or {:error, :self_check_failed}, and no signature leaves the module. A seed and public key that are not a pair cannot produce a signature.
• No prehash, no context: :crypto.sign/4 and :crypto.verify/5 with :mldsa87 and :none as literals and no options argument. The census now covers both modules and pins this.
• Refusals are answers carrying no key byte, as for Ed25519. On OTP 27, or an OTP linked to OpenSSL before 3.5, every call answers {:error, :crypto_refused}. The package floor stays OTP 27.
• Hedged: two signatures of the same bytes differ; both verify.

Tests and CI

• test_helper.exs runs the ML-DSA tests where :crypto offers mldsa87, and the :crypto_refused test where it does not. With MLDSA_REQUIRED=1 (the box leg) a runtime without ML-DSA-87 is refused, so that leg cannot pass by skipping.
• Vectors: NIST ACVP and Wycheproof ML-DSA-87, every case :crypto can express (ACVP 1 of 60, Wycheproof 234 of 241). The rest are counted by reason (a non-empty context, HashML-DSA, the internal interface), so a case that comes into reach fails the count until it runs. tools/vectors_mldsa87.sh writes the fixtures from pinned commits, checked by sha256. The fixtures are test-only and not in the Hex package.
• Other implementations: the box leg writes one signature, and the new job "ML-DSA-87 cross-verify (Go crypto/mldsa, aws-lc-rs)" verifies it with Go 1.27.3's crypto/mldsa and with aws-lc-rs 1.18.2 (Cargo.lock, Rust 1.92.0). Each must refuse it over the message with one bit flipped. Go also confirms the public key is the one the seed derives.
• Latency: the box leg records ML-DSA-87 latency (tools/bench_mldsa.exs), with no threshold. A shared runner's figure is the runner's.
• One existing test fixed: Ed25519's "nothing kept" test matched ETS tables by name, and ExUnit's per-module tables matched once more test files were compiling. It now refuses any table the call leaves owned by the calling process.

Evidence (local)

• OTP 28.5.0.8 over OpenSSL 3.5.9 with Elixir 1.20.4: every CI step exits 0; Result: 37 passed, 1 excluded.
• OTP 28.5.0.8 over OpenSSL 3.0.13 with Elixir 1.18.4: every step exits 0; 38 tests, 0 failures, 11 excluded. With MLDSA_REQUIRED=1 it is refused (exit 1).
• Go and aws-lc-rs accept the signature and refuse the flipped message; a tampered signature fails both (exit 1).
• Eleven mutants of the module, each compiling clean: ten killed. The survivor removes the second check, which cannot fail on a correct runtime; it guards against a faulty one.
• reuse lint: compliant. The ACVP fixtures are under NIST-Software, Wycheproof under Apache-2.0, each with the change noted.

Not yet measured

• OTP 27 with Elixir 1.17, the floor leg: not installed locally; this run is its measurement.
• The cross-verify job and the aarch64 latency: this run is their first.

Before merging

• The ruleset gains "ML-DSA-87 cross-verify (Go crypto/mldsa, aws-lc-rs)" as a required check once it has run green here, so GOVERNANCE's "seven checks" is true when this lands.