Stabilize the last Windows-only hostile lifecycle CI blocker

[shrec]

What

• Stabilized the last Windows-only CI blocker in exploit_ctx_lifecycle_hostile on main.
• Replaced a brittle post-precompute external sign/verify roundtrip probe with ecdsa_sign_verified() validity checking.
• This keeps the audit focused on the real invariant: fixed-base precompute init must not poison the ECDSA signing flow.

How to get it

• Branch: main
• Commit: a72e24f1