Reject invalid API inputs before unsafe work

[fegge]

Summary

• Reject malformed public API inputs before allocation, copying, or length arithmetic that depends on those inputs.
• Tighten external-mu, context, signature-length, and signed-message overflow checks.
• Add allocator and functional regression coverage for the rejected inputs.

Validation

• clang-format -i mldsa/src/sign.c mldsa/src/sign.h mldsa/mldsa_native.h test/src/test_alloc.c test/src/test_mldsa.c: passed
• git diff --check -- mldsa/src/sign.c mldsa/src/sign.h mldsa/mldsa_native.h test/src/test_alloc.c test/src/test_mldsa.c: passed
• make run_alloc run_func -j4: passed
• Not run: ./scripts/format because nixpkgs-fmt is not installed in this local environment
• Not run: ./scripts/lint because shfmt is not installed in this local environment

Fixes #1212

---

This work was completed by Trail of Bits as part of the Patch The Planet project in collaboration with OpenAI. The issue was identified primarily by the Codex coding agent, and manually reviewed before submission.

[fegge]

Reopened from an upstream repository branch with DCO-signed commits so full CI can run: #1231