Feature: ungate signing from behind `dilithium_kat` or add to features list in Cargo.toml

Currently, the sign module is private, and the api module doesn't publicly expose its members either. In lib.rs, it's gated like so:

```rs
#[cfg(dilithium_kat)]
pub use sign::{
crypto_sign_keypair, crypto_sign_signature, crypto_sign_verify,
};
```

This means the gate condition must be included in rust_flags, as the feature is also not in the manifest.

Start by reading lib.rs and Cargo.toml, then inspect how the private sign and api modules are exposed. Verify whether signing can be used without manually adding dilithium_kat to rust_flags, or whether the condition is declared as a Cargo feature. Done means the intended public signing API builds through the manifest configuration.

Written by the indexing model from the issue text.