schnorr_fun v0.13.0 release

[LLFourn]

Summary

Release branch bumping schnorr_fun to v0.13.0 and secp256kfun to v0.12.1.

• schnorr_fun/Cargo.toml: 0.12.0 → 0.13.0
• secp256kfun/Cargo.toml: 0.12.0 → 0.12.1 (only #[must_use] additions on HashAdd — non-breaking)
• Workspace schnorr_fun dep pin: "0.12" → "0.13" (secp256kfun pin left at "0.12" since 0.12.1 satisfies)
• CHANGELOG.md: new ## schnorr_fun v0.13.0 section

What's in v0.13.0

A security audit of chilldkg (#247, #248) produced a batch of fixes and an
API rework. Highlights — see CHANGELOG.md for the full list.

Security

• PoP binds slot index + parity (closes cross-slot replay capability)
• Certifier::receive_certificate always verifies signatures (fixes silent acceptance of unverified VRF certs on duplicate registration)
• CertifiedKeygen no longer serializable (closes attacker-chosen-gamma path through vrf_security_check)
• SecretShareReceiver::finalize rejects unexpected cert-map entries (no VRF beacon pollution)
• receive_secret_share validates share index and encryption key
• Contributor count is enforced across simplepedpop/encpedpop/certpedpop layers (closes ghost-contributor padding)
• DoS panics on adversary-supplied AggKeygenInput and SharedKey decoding fixed

API breaking

• Contributor is type-parameterized by role (ShareReceiver / AuxContributor); wrong-role calls become compile errors. Unified gen_keygen_input.
• verify_agg_input is per-role; the ShareReceiver variant atomically pairs the share. In certpedpop, the share is gated behind SecretShareReceiver::finalize.
• cert_bytes() binds the receiver-encryption keys and aux contributor keys via the verifier's local state; coordinator-supplied keyset substitution fails certification.
• Receiver encryption keys leave the encpedpop wire form; aux contributor keys stop being a finalize parameter. Both move onto the contributor at gen_keygen_input time.
• Coordinator::add_input and missing_from use a Party enum.
• &'static str errors replaced with typed enums; broad errors split into per-function variants.
• PoP domain separator changed to "BIP DKG/pop message" matching the BIP DKG draft (wire-incompatible with old PoPs).