X448.cswap
Conditional swap for the Montgomery ladder.
Swaps a and b if swap is non-zero. The swap is performed with mask arithmetic (XOR of limbs under an all-ones/all-zeros mask) so no branch depends on the secret scalar bit; a tmp-based swap would branch straight on it.