fix: harden Signet Forge crypto, WAL, reader, and compliance paths #72

Job	Run time
UBSan (Ubuntu)	1m 23s
Full Suite 394/394 (Ubuntu)	57s
TSan (Ubuntu)	1m 18s
Server Codecs (Ubuntu)	1m 5s
Build & Test (Windows / MSVC)	3m 4s
Build & Test (ubuntu-24.04)	53s
ASan + UBSan (Ubuntu)	1m 9s
Build & Test (macos-14)	52s
Post-Quantum PQ (Ubuntu)	1m 24s
License Compliance	1m 53s
Secrets Scan (gitleaks)	5s
Coverage (Ubuntu, Clang-18)	1m 18s
Python SAST (bandit)	12s
Mutation Testing Baseline (Ubuntu)	1m 0s
Benchmarks (Ubuntu)	52s
Fuzz (Ubuntu, Clang-18)	20s
	17m 45s

Provide feedback