Post-quantum key encapsulation: Replace RSA-OAEP with ML-KEM-768 (FIPS 203) for sealing

France's ANSSI will [stop certifying non-PQC products from 2027](https://gizmodo.com/the-quantum-threat-to-encryption-is-coming-france-just-set-a-2027-deadline-2000773650). The US [Executive Order 14409](https://www.whitehouse.gov/presidential-actions/2026/06/securing-the-nation-against-advanced-cryptographic-attacks/) mandates PQC for all federal systems - key establishment by 2030, digital signatures by 2031.

## Context

The project's own [crypto.md](https://github.com/bitnami-labs/sealed-secrets/blob/main/docs/developer/crypto.md) acknowledges RSA-OAEP is "NOT quantum-resistant" and lists replacement candidates. However, the candidates listed (LMS, XMSS, McEliece) are hash-based *signature* schemes or legacy KEMs - not the NIST-standardized KEM.

The correct replacement for RSA-OAEP key encapsulation is **ML-KEM-768 (FIPS 203)**, standardized by NIST in August 2024.

## Proposal

Replace RSA-4096-OAEP with hybrid RSA-4096 + ML-KEM-768 for key encapsulation:
- Sealed secrets encrypted with both classical RSA and ML-KEM
- AES-256-GCM symmetric encryption unchanged (already quantum-safe)
- Backward compatibility: old sealed secrets remain decryptable

Go 1.24+ has `crypto/mlkem` in stdlib. `filippo.io/mldsa` provides ML-KEM as a bridge.

## References

- [NIST FIPS 203 (ML-KEM)](https://csrc.nist.gov/pubs/fips/203/final)
- [crypto.md acknowledgment of vulnerability](https://github.com/bitnami-labs/sealed-secrets/blob/main/docs/developer/crypto.md)

Start with docs/developer/crypto.md to understand the current RSA-OAEP design and then trace the existing sealing and decryption implementation. Confirm how hybrid RSA-4096 plus ML-KEM-768 can preserve decryption of old sealed secrets; done means AES-256-GCM remains unchanged, new secrets use both mechanisms, and compatibility is covered by the project's tests.

Written by the indexing model from the issue text.