tls v0.1.16 — FIPS/PQC seam release

First tls release with the -Dfips dual-mode seam (std.crypto shim /
OpenSSL FIPS backend): AES-GCM record layer, HKDF/HMAC key schedule,
classical + ML-DSA CertificateVerify and X.509 chain verification,
X25519MLKEM768 hybrid key exchange — all routed through the fips seam.
fips dependency pinned to the published git+https v0.1.0.