Both autotools (configure.ac) and CMake (cmake/SystemIntrospection.cmake)
now try -mpclmul first and, on hosts where that fails, fall back to
-march=armv8-a+crypto (aarch64). Whichever check succeeds sets the same
HAVE_CLMUL and CLMUL_CXXFLAGS that the rest of the build system
already consumes.

HAVE_CLMUL now means "a carryless-multiply ISA is available," not
specifically x86 CLMUL. ENABLE_CLMUL is widened to ENABLE_CLMUL || ENABLE_PMULL.
A host only has one carryless-multiply ISA, so the fallback chain compiles
with the flag that actually matches the target.

MSVC ARM64 is deliberately excluded — it uses a different header and flag
convention and is out of scope here.

The wrapper functions introduced by the previous refactor now have two
implementations selected at compile time:

  __PCLMUL__                                  -> x86 (PCLMULQDQ)
  __ARM_FEATURE_CRYPTO / __ARM_FEATURE_AES    -> ARMv8 (PMULL/PMULL2)

The ARM backend uses the dual-type alias the refactor set up:

  Clmul128  = uint64x2_t     — in-flight data (lane shifts, XOR, OR)
  ClmulPoly = poly64x2_t     — vmull_p64 operand type

PMULL operands are extracted via vgetq_lane_p64 from poly64x2_t. Modern
aarch64 compilers (GCC 13+, Clang 19+) fuse vgetq_lane_p64 + vmull_p64
into a direct PMULL with NEON register operands, so values stay in the
SIMD pipeline without SIMD->GPR roundtrips. MOD128 is pre-loaded once as
a ClmulPoly at the top of MulWithClMulReduce and reused across reduction
rounds, avoiding per-call re-materialization.

MulWithClMulReduce uses only the 0x00 and 0x01 imm8 selectors of x86
PCLMULQDQ — i.e. lo(a)xlo(b) and hi(a)xlo(b). Those map to vmull_p64 on
lane-0/lane-0 and lane-1/lane-0 respectively. vmull_high_p64 (PMULL2)
isn't needed.

Scalar loads use vsetq_lane_p64 into a zero-initialized vector,
mirroring the x86 _mm_cvtsi64_si128 semantics (payload in lane 0, lane 1
zero). Lane-shift wrappers map to vshrq_n_u64 / vshlq_n_u64 directly;
byte-shift maps via vextq_u8 against a zero vector.

A compile-time #error fires if neither ISA is selected, so accidental
inclusion in a non-accelerated build fails loudly instead of silently
falling back.

Extend the existing x86 CPUID check with ARM-specific branches so that
the same EnableClmul() gate works on either ISA. Dispatch is on
architecture predefined macros (__x86_64__/__i386__/_M_X64/_M_IX86 vs
__aarch64__/__arm__/_M_ARM64), then on OS:

  Apple         always true (A7+ and Apple Silicon have PMULL)
  Windows       IsProcessorFeaturePresent(PF_ARM_V8_CRYPTO_INSTRUCTIONS_AVAILABLE)
  Linux         getauxval(AT_HWCAP) & HWCAP_PMULL        (aarch64)
                getauxval(AT_HWCAP2) & HWCAP2_PMULL      (arm32)
  FreeBSD       elf_aux_info(AT_HWCAP, ...)
  other         true (trust the compile-time gate)

The FieldImpl enum, extern declarations, and Construct() dispatch are
unchanged — impl=CLMUL on an ARM build now maps to the PMULL-backed
MulWithClMulReduce, transparently to library consumers.