Bump libs/nistcurves → v0.10.1 and libs/x25519 → v0.11.0: pinned pair carries the lib-contract #82/#83 collisions at tags #112

The lib-contract phase-3 namespace wave is complete
(JC-000/c64-lib-contract#76): all four crypto libraries are v0.9.2-conformant
at tags. This repo's current pins are the pre-wave pair:

Why the bump matters here specifically

The pinned pair carries the lib-contract #82 defect live at these tags:
both libraries' reu_config objects export the same unprefixed
LIB_SHARED_REU_MUL_{BANK,OFFSET,BANKS_USED}, so a link that pulls both dies
with ld65: Error: Duplicate external identifier — measured with exactly this
pair. The #83 bare-ZP overlap (zp_ptr1/zp_tmp1/zp_tmp2) is also present
at these tags.

At the wave tags the pair is collision-free, gated and ungated — verified
end-to-end during the wave close, including a -D LIB_NO_BARE_EXPORTS=1 build
of each exporting zero unprefixed names.

Upgrade notes (small, but two gates move)

• LIB_NISTCURVES_ABI_VERSION is now 2 (was 1): the three colliding
  unprefixed §8.2 inputs were removed; prefixed
  LIB_NISTCURVES_SHARED_REU_MUL_* outputs replace them, enabling the §8.2
  placement-agreement assert across the pair. x25519's ABI is 3. Update
  any .assert ... ABI_VERSION = N gates.
• nistcurves v0.10.x PRG grew 37427 → 37480 B (a 53-byte image-shortfall fix);
  RESIDENT_BYTES figures are per-archive since v0.9.x — re-read any §5 fit
  checks rather than carrying old constants.
• Recommended composed-build shape per SPEC §6.5: build both libraries with
  -D LIB_NO_BARE_EXPORTS=1 and import canonical prefixed names only.
• Both libraries' CONTRACT_DEFINES / CONTRACT_ZP_DEFINES make variables
  now actually forward consumer defines (SPEC §6.2), so any override this repo
  previously applied by editing library Makefiles can move to the documented
  interface.

Do not pin v0.10.0 of nistcurves — it ships content self-reporting as 0.10.1
and is documented-as-superseded; v0.10.1 is the same content with a consistent
identity.

Filed from the nistcurves side as part of the #76 consumers.md refresh;
cross-linked there.