Document signing secret-key validity precondition

[fegge]

Summary

• Document that signing APIs require a valid secret key.
• Point callers to pk_from_sk when they need to validate a serialized secret key before signing.
• Add a Wycheproof client comment explaining why InvalidPrivateKey signing vectors are skipped while pkFromSk still tests those keys.

Validation

• clang-format -i mldsa/src/sign.h mldsa/mldsa_native.h: passed
• ruff format test/wycheproof/wycheproof_client.py: passed
• ruff check test/wycheproof/wycheproof_client.py: passed
• python3 -m py_compile test/wycheproof/wycheproof_client.py: passed
• git diff --check -- mldsa/src/sign.h mldsa/mldsa_native.h test/wycheproof/wycheproof_client.py: passed
• make run_func -j4: passed
• make wycheproof -j4: passed
• python3 test/wycheproof/wycheproof_client.py --data-dir <fresh-temp-dir>: passed
• Not run: ./scripts/format because nixpkgs-fmt is not installed in this local environment
• Not run: ./scripts/lint because shfmt is not installed in this local environment

Fixes #1216

---

This work was completed by Trail of Bits as part of the Patch The Planet project in collaboration with OpenAI. The issue was identified primarily by the Codex coding agent, and manually reviewed before submission.

[fegge]

Reopened from an upstream repository branch with DCO-signed commits so full CI can run: #1229