Implement verified Triple DES ECB on AArch64

[reaperhulk]

Adds complete AArch64 Triple DES ECB support for the existing public in-place API, with 16-byte and 24-byte keys and both encryption and decryption. Depends on #504; this PR contains only the AArch64 implementation and its API/test/benchmark architecture gates.

All five entrypoints are verified against the merged shared spec: key expansion, block encryption/decryption, and ECB encryption/decryption. Assembly is generated by the Lean emitter. The scalar implementation uses Boolean S-box circuits with fixed scratch locations, public round-key traversal, register-resident Feistel halves, and one IP/FP pair for all three DES passes. It saves the link register around ECB block calls. No Spec or TCB changes.

Reviewed OpenSSL DES and AWS-LC DES. Both use secret-indexed S/P tables, so this implementation borrows their three-pass composition and half-register structure while using constant-time Boolean circuits. The existing end-to-end benchmark compares both key lengths and directions with OpenSSL at 64, 1024 and 16384 bytes; native AArch64 measurements will come from CI.

Validation: full Lean build (5,799 jobs), emitter generation and check including axiom/compiler audits; all repository import, proof-speed, vector, architecture-gate, variant and MCDT checks; root and benchmark formatting/clippy; AArch64 cross-clippy and the entire Rust suite under QEMU, including all 500 published NIST ECB cases in both directions, block-aligned splits, parity and limits. Native baseline-feature Rust tests also pass. Rust logic is shared with #504, whose combined CI coverage is 100%.