[ccipherx]

Replace hardened ctutils selects in module-lattice arithmetic with select-free kernels using 16-bit Montgomery and Barrett reductions. This removes per-butterfly memory spills and enables x86 vectorization.

Benchmarks

	ML-KEM-512	ML-KEM-768	ML-KEM-1024
KeyGen	30.7 → 10.4	50.3 → 17.1	75.2 → 27.0
Encaps	36.3 → 5.6	56.6 → 7.2	82.6 → 10.1
Decaps	51.3 → 8.8	77.4 → 11.7	109.0 → 16.1
EK parse	2.6 → 6.7	3.9 → 12.9	5.2 → 21.2

Trade-offs

• Matrix caching adds 2 / 4.5 / 8 KiB per key and moves expansion to EncryptionKey::new.
• thumbv7em .text grows 17% (70,876 → 83,216 bytes).
• KeyGen-768 worst-case stack grows 30.1 → 41.7 KB. Decaps stack drops by up to 16%.

[tarcieri]

Thanks, this looks promising but I need some time to review it

[tarcieri]

I think some of this might be worth extracting into module-lattice too so we can reuse it with ml-dsa, but let's start with it just in ml-kem and then follow up on that.

[ccipherx]

I think some of this might be worth extracting into module-lattice too so we can reuse it with ml-dsa, but let's start with it just in ml-kem and then follow up on that.

sounds good, will create a follow up pr