exec-server: add Noise channel foundation

[viyatb-oai]

Why

The harness and exec-server need endpoint-authenticated encryption across a rendezvous relay that must not see or modify JSON-RPC plaintext. This first layer introduces the cryptographic identity and handshake foundation without changing any runtime connection path.

What changes

• Adds the Clatter hybrid-IK dependency and an AWS-LC ML-KEM-768 adapter.
• Introduces strongly typed Noise channel identities and public keys.
• Validates the declared suite, canonical key encoding, and exact X25519 and ML-KEM key lengths.
• Adds focused crypto-wrapper tests.
• Configures BLAKE3 intrinsics for the Windows GNU Bazel target so the new dependency graph links in cross-platform CI.

This PR is independently landable and does not activate Noise in exec-server.

Stack

1. #26239 - channel foundation
2. #26242 - relay and provider transport
3. #26245 - remote activation, hardening, and E2E