DC-CRYPTO-08

Ade-owned Sum6KES algorithm is Haskell-equivalent. ade_crypto::kes_sum::Sum6Kes is byte-identical to Haskell cardano-base's Sum6KES Ed25519DSIGN: derive_verification_key, gen_key_kes_from_seed_bytes, update_kes (chain across all 64 periods), and sign_kes produce the same bytes as the Haskell reference for every (seed, period, msg) triple. Cross-impl validation against the cardano-cli ground-truth corpus is mechanically enforced under #[cfg(test)] only (3 throwaway 608-byte SKEY + VKEY pairs captured from cardano-cli 11.0.0.0; deserializing the SKEY through our impl produces the captured VK byte-for-byte). Note: cardano-crypto Rust 1.0.8 uses different expand_seed prefix bytes (0x00/0x01 vs Haskell's 0x01/0x02) — Ade matches Haskell, NOT cardano-crypto Rust; this divergence is asserted explicitly in sum6_kes_seed_expansion_diverges_from_cardano_crypto_rust_1_0_8. After PHASE4-N-P S5, KesSecret.inner is the Ade-owned signing key; cardano-crypto is a #[cfg(test)] oracle only. No compatibility shim may construct an upstream SumSigningKey through unsafe layout assumptions, transmute, vendored pub(crate) access, or fork-only constructors (N9), enforced by ci/ci_check_kes_sum_compatibility.sh Guard 3.