Upgrade sntrup from round-1 (sntrup4591761) to sntrup761

hpqc's `kem/sntrup` wraps `github.com/katzenpost/sntrup4591761`, which is the
round-1 Streamlined NTRU Prime construction: SHA-512 confirmation, an explicit
(k, ok) return, and no dedicated rejection secret (rho) in the private key.

The current, standardized Streamlined NTRU Prime is sntrup761 (used by OpenSSH),
which uses implicit rejection: decapsulation never fails; on an invalid
ciphertext it returns a pseudo-random key derived from a secret rho,
indistinguishable from a valid key. hpqc's round-1 scheme predates this.

The `kem/sntrup` scheme is now marked Deprecated to signal this. It should be
replaced with a sntrup761 implementation. Note this changes parameters and the
wire format, so it is not drop-in and needs a migration plan.

Refs:
- https://ntruprime.cr.yp.to/
- https://www.ietf.org/archive/id/draft-josefsson-ntruprime-streamlined-00.html

Start by inspecting the kem/sntrup package and its use of github.com/katzenpost/sntrup4591761, then read the linked NTRU Prime references. Define the migration plan for the changed parameters and wire format before replacing the deprecated round-1 scheme with sntrup761, including its implicit-rejection behavior.

Written by the indexing model from the issue text.