v0.4.1rc2 - post-quantum signing

Pre-release. Adds post-quantum / hybrid (ML-DSA + Ed25519) signing via the optional [pqc] extra, on top of the 0.4.1rc1 security hardening. pip install --pre attestix. Classical path unchanged; stable 0.4.0 unaffected.