build: bump oqs to 0.11.0 and patch oqs-sys to bindgen 0.72 so the binding builds on rust:1.98-alpine

[Apolloccrypt]

Why

paramant-relay's dependabot PR Apolloccrypt/paramant-relay#313 (rust 1.95-alpine -> 1.98-alpine) fails to build the crypto binding with error[E0609]: no field alg_version on type &OQS_SIG. Pinning rust at 1.95 was the stopgap; this PR fixes the actual cause so the relay can build on a current toolchain.

Root cause (measured inside rust:1.98-alpine@sha256:a10e64dd..., Alpine 3.24, clang 22.1.3)

liboqs's sig_stfl.h forward-declares typedef struct OQS_SIG OQS_SIG; before sig.h defines it. bindgen 0.71 resolves that typedef to the incomplete declaration under libclang 22 and emits OQS_SIG as an opaque { _address: u8 }, so every field access in oqs fails. Two-line reproduction (typedef struct Foo Foo; typedef struct Foo { int a; const char *b; } Foo;):

bindgen	libclang	struct Foo
0.71.1	22.1.3	opaque (_address)
0.71.1	21.1.8	a, b
0.72.1	22.1.3	a, b

The rustc version is irrelevant: rust-toolchain.toml pins 1.95.0, and the failure reproduces with that toolchain inside the 1.98 image.

Change

• oqs 0.10.1 -> 0.11.0 (oqs-sys 0.11.0, vendored liboqs 0.12.0 -> 0.13.0). API changes in oqs 0.11 are additive (keypair_derand, UOV); no source changes in paramant-core.
• oqs-sys 0.11.0 on crates.io still requires bindgen 0.71. Upstream bumped it to 0.72 in build(deps): update bindgen requirement from 0.71 to 0.72 open-quantum-safe/liboqs-rust#289 (commit 4ca07ba) but has not released a new oqs-sys. [patch.crates-io] pins that commit: it is the published 0.11.0 tree plus that one-line bump (verified: Cargo.toml.orig and build.rs of the crates.io tarball are byte-identical to the parent commit a67875e; git diff a67875e 4ca07ba -- oqs-sys is the single bindgen line; liboqs submodule is tag 0.13.0 / 21b3f8b in both). Cargo.lock now resolves bindgen 0.72.1.
• musl-node-binding CI job: base image moved to the same rust:1.98-alpine digest the relay Dockerfile will ship, so this job goes red if the base ever breaks the binding again.
• CHANGELOG entry under Unreleased.
• deny.toml: allow-git for the liboqs-rust repo, since [sources] unknown-git = "deny" would otherwise fail the audit * deny job on the patched source. cargo deny check passes locally (advisories, bans, licenses, sources).

Byte-compatibility

• OQS_SIG_alg_ml_dsa_65, OQS_SIG_alg_ml_kem_768, OQS_SIG_alg_sphincs_sha2_128f_simple, OQS_SIG_alg_falcon_512 exist unchanged in liboqs 0.12.0 and 0.13.0 headers.
• tests/kat/ml-dsa-65.json (50 @noble-anchored vectors) and ml-kem-768.json verify unchanged.
• paramant-relay crypto suite (144 tests, node --test crypto/*.test.js) passes against the binding built from this branch: 144 pass, 0 fail.

Tests

• cargo test --locked --workspace (glibc, Fedora, libclang 21): all suites pass, 0 failed.
• Inside rust:1.98-alpine (musl): cargo build --locked --release -p paramant-core-node succeeds, generated sig_bindings.rs contains the OQS_SIG fields, and cargo test --locked --release -p paramant-core --test kat_ml_dsa_65 --test kat_ml_kem_768 --test proptest_sig passes (2 + 2 + 1).

Follow-up

• paramant-relay: bump PARAMANT_CORE_COMMIT (Dockerfile) and PARAMANT_CORE_SHA (test.yml) to this commit together with the rust 1.98-alpine bump; that PR supersedes #313.
• Drop the [patch.crates-io] block once an oqs-sys > 0.11.0 ships with bindgen >= 0.72.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XJk2nCLCLmi3F71qkCUn7N