[crypt0miester]

the variable codec refused past one packet with no allocator and had no ceiling with one. the quadratic cost needs a ceiling either way, and a vector path's signature batch was staging limbs through memory to re-enter a target_feature call per lane.

• MAX_ACCEPTED_LEN: 4096 with alloc, one packet without, held on encode, decode, and the leading-ones decode path
• a batch asks the backend whether to run each input alone; x86 vector paths encode signatures direct, aarch64 runs keys and decodes direct
• the skip a spelled key drops is clamped to what its encoding allows, in one helper, with the old debug assert kept
• neon words_from_limbs accumulates on a parity branch and sums in registers, no scratch array; m4 fixed-width rows re-measured, unchanged within 1%
• the x86 write_* wrappers are re-exports, the dead vector write_64 kernels are gone

tests: round-trip at and past the ceiling on both feature builds, batch matches single on every path; ci jobs green locally on stable, msrv, thumbv6m, nightly fuzz, and x86-64 linux