[roy-basmacier]

Adds the three BLAKE hashes requested in #123 for OpenSSL provider provisioning, on the key-object API of feature/key-rework-memory (#172): two new crates wired into the factories, the CLI and the stack-memory benches. Other BLAKE2 digest lengths, salt/personalisation, BLAKE2bp/sp/X and tree mode are out of scope.

blake2 (new crate bouncycastle-blake2):

• BLAKE2b_512 and BLAKE2s_256 implement Hash and Suspendable; G, F, the parameter block and the final-t rule are commented against RFC 7693 s. 3.1-3.3. blake2b.rs and blake2s.rs are kept structurally identical.
• The native keyed mode (not HMAC): key objects BLAKE2b_512_MACKey and BLAKE2s_256_MACKey (FromAnyKeyMaterial, MacGenerationKey, MacVerificationKey) hand out BLAKE2b_512_MAC / BLAKE2s_256_MAC workers. Key checks run type, then strength, then length (1..=64 / 1..=32).
• AlgorithmOID: id-blake2b512 and id-blake2s256 (RFC 7693 s. 4), on the hash and MAC types.

blake3 (new crate bouncycastle-blake3):

• BLAKE3 implements Hash and XOF in hash mode (new) and derive_key mode (new_derive_key); BLAKE3Squeezer streams the extended output.
• keyed_hash: key object BLAKE3KeyedHashKey (exactly 32 bytes) hands out BLAKE3KeyedHash workers, which keep an inherent into_squeezer for extended output. BLAKE3KeyedSqueezer is deliberately not Suspendable.
• The engine follows the reference implementation's chunk state and 54-entry CV stack (spec s. 2.4-2.6, 5.1).

Both crates:

• MAC output truncates to the caller's buffer with a 4-byte floor (MIN_MAC_OUTPUT_LEN); every _out function zeroizes the buffer before any error check. Partial-bit input: 0 bits is a whole-byte message, 1..=7 returns InvalidInput, more returns InvalidLength.
• Keyed workers implement SuspendableKeyed with the key object as the key. Suspended states hold no key bytes, and resume rebuilds the key-derived fields from the key object.
• Design note: a suspended keyed state still lets its holder compute tags for extensions of the absorbed prefix (BLAKE2 once the key block is compressed; BLAKE3 only within the first chunk). HMAC does not have this property. It is documented and pinned by tests.

factory: HashFactory gains BLAKE2b-512, BLAKE2s-256 and BLAKE3; XOFFactory gains BLAKE3; MACFactory gains the three BLAKE MAC keys and workers.

cli: blake2b-512, blake2s-256, blake2b-512-mac, blake2s-256-mac, blake3, blake3-keyed-hash and blake3-derive-key, all streaming. cli/tests/ test_blake.sh adds 16 tests on the shell harness.

tests: RFC 7693 Appendix A/B, selections from the official BLAKE2 KAT, the bc-test-data Blake2KAT.txt sweep (512 + 512 records), all 35 official BLAKE3 vectors in all three modes, and the core-test-framework suites for Hash, XOF, MAC keys, key construction and suspend/resume. Wycheproof has no BLAKE vectors. cargo mutants: blake2 378 tested, 10 missed; blake3 384 tested, 9 missed, 8 timeouts (non-terminating loops); every miss is an equivalent rewrite with a "Mutants note:" at the site.

#![no_std] remains a todo in both crates, as in every hash crate, blocked by the Vec return types in core::traits::Hash.

Assisted-by: Claude:claude-mythos-5-1
Assisted-by: Claude:claude-fable-5-1
Assisted-by: Claude:claude-opus-5-5