Monitor ed25519-bip32 upstream hardening release (non-blocking)

Parent implementation: #177
Dependency decision: ADR 0078
Upstream-remediation policy: ADR 0089
Upstream issue: https://github.com/typed-io/rust-ed25519-bip32/issues/8
Upstream pull request: https://github.com/typed-io/rust-ed25519-bip32/pull/9

## Standing decision

This is a **monitor-only, non-blocking** issue.

The SDK continues using the immutable `ed25519-bip32 0.4.3` release as a private,
feature-gated implementation dependency behind SDK-owned redacted and zeroizing
types. The open upstream pull request is an optional ecosystem improvement, not
an sdk-rust delivery dependency.

No sdk-rust roadmap item, pull request, milestone, active-development release or
agent queue may wait for upstream pull request #9. The SDK must not point at its
unpublished branch, and no SDK-maintained fork is justified solely by upstream
latency.

## Monitoring triggers

Re-evaluate only when one of these events occurs:

- upstream pull request #9 is merged and an immutable crate release is published;
- upstream closes or materially changes the contribution;
- a RustSec advisory, maintenance loss, supported-target failure or conformance
regression changes the accepted risk;
- sdk-rust enters release-candidate preparation and the residual risk requires a
fresh release decision.

Routine elapsed time is not a trigger.

## Work after a trigger

Create a separate bounded implementation or decision issue. Do not implement
from this monitor directly. A released-version evaluation must rerun the ADR
0078 evidence: Apollo/upstream vectors, public API isolation, secret redaction,
zeroization, MSRV/etalon and supported-target builds, dependency-cone inspection,
unsafe review and advisory gates.

If an immutable safe release is not available, sdk-rust remains on 0.4.3 under
the existing facade and documented limitation unless a new ADR authorizes a
different dependency or a maintained fork.

## Current status

- SDK delivery: unblocked
- Required agent action: none
- Upstream watch: open
- Closure condition: the upstream outcome has been evaluated in a separate
sdk-rust issue and the dependency decision has been updated, if necessary

Read ADR 0078 and ADR 0089, then inspect upstream issue #8 and pull request #9. No implementation or test run is required from this monitor; it is done when an upstream outcome is evaluated in a separate sdk-rust issue and the dependency decision is updated if needed.

Written by the indexing model from the issue text.