feat: ml-dsa preference list and gated availability (#768)