crypto: add testkit subpath export and export-surface guard

[jithinraj]

Summary

• Add @peac/crypto/testkit subpath export for test-only utilities
• Fix ESM import hygiene (./errors.js suffix)
• Add exports.test.ts to guard that generateKeypairFromSeed is NOT in main entry

Key design

Production bundlers can tree-shake testkit away since it's a separate export path:

```typescript
// Test fixtures only - NOT exported from main entry
import { generateKeypairFromSeed } from '@peac/crypto/testkit';
```

Test plan

• CI passes
• exports.test.ts passes (guards export surface)
• generateKeypairFromSeed NOT in main @peac/crypto exports

Stacked PRs

1. PR1 -> main: kernel codegen + bundle error codes
2. PR2 -> PR1: audit dispute bundle verifier
3. PR3 (this) -> PR2: crypto testkit subpath export
4. PR4 -> PR3: CI drift gate

Merge in order: PR1 -> PR2 -> PR3 -> PR4