Demote HAETAEEngine to package-private

Per CLAUDE.md "PQC engines should stay package-private" — the
HAETAEEngine has no callers outside the org.bouncycastle.pqc.crypto.haetae
package (only referenced by HAETAESigner and HAETAEKeyPairGenerator), and
the HAETAE tests drive the public HAETAEKeyPairGenerator / HAETAESigner
surfaces rather than instantiating the engine directly. Demoting the
class and its constructor to package-private keeps the engine out of the
published bcprov API surface so future internal refactors aren't
constrained by a load-bearing public signature.