Add keyed bao methods

[cryptoquick]

Summary

Adds keyed BLAKE3 mode so merkle roots depend on a 32-byte key, not just the data. Same bytes with different keys produce different roots — useful when you want the tree to commit to out-of-band metadata (e.g. a Carbonado format byte) without putting that metadata in the blob itself.

The design follows BLAKE3’s own split: existing APIs are unchanged, and new keyed_* wrappers take an extra key: &[u8; 32] the same way blake3::keyed_hash relates to blake3::hash. BaoTree is unchanged; the wire format is unchanged. The key is never serialized into the encoded stream — both sides must agree on it out of band.

API surface

Core (lib.rs): keyed_hash_subtree, keyed_parent_cv

Sync I/O (io/sync.rs): keyed_outboard, keyed_outboard_post_order, keyed_encode_ranges_validated, keyed_decode_ranges, keyed_valid_ranges, plus CreateOutboard::create_keyed / create_sized_keyed / init_from_keyed

Async I/O (io/fsm.rs): async equivalents of the above

In-memory outboards (io/outboard.rs): PostOrderMemOutboard::create_keyed, PreOrderMemOutboard::create_keyed

Internally, keyed and unkeyed paths share the same helpers with an Option<&[u8; 32]> — no duplicated hash logic.

Usage

let key: [u8; 32] = /* agreed out of band, e.g. format/domain id */;

// Build outboard with keyed root
let outboard = PostOrderMemOutboard::create_keyed(&data, block_size, &key);

// Encode/decode — pass the same key on both sides
keyed_encode_ranges_validated(&data, &outboard, &ranges, &mut encoded, &key)?;
keyed_decode_ranges(&mut encoded, &outboard, &mut decoded, &key)?;

Root hashes match blake3::keyed_hash(&key, &data) for full blobs.

Tests

55 keyed_* tests (124 total passing), covering sync and FSM paths:

• Low-level primitives cross-checked against BLAKE3 hazmat
• Full and partial encode/decode roundtrips, including proptests
• Wrong-key rejection on encode and decode
• Cross-mode rejection (keyed encode + unkeyed decode, and the reverse)
• Outboard construction via every public entry point (create_keyed, create_sized_keyed, init_from_keyed, keyed_outboard, keyed_outboard_post_order)
• keyed_valid_ranges positive, wrong-key, and corrupted-outboard cases

Breaking changes

None. All existing functions and types behave as before.

---

Closes #76

[rklaehn]

I haven't really looked at the code yet, but what it does is definitely something that is in scope for this crate. So thank you!

[cryptoquick]

I will be testing it out in my Carbonado v2 work, and will let you know how well it works!

[cryptoquick]

Unless I discover something truly egregious in my Lean proving efforts and other end to end testing, I consider this work ready for review.

[rklaehn]

There are a few minor things I would want changed, so I am going to make a branch based on this and let you review.

[rklaehn]

#78