Fix ML-DSA ACVP registration and restore sigVer coverage

[JunMin765677]

Summary

• add the required preHash and contextLength properties to the ML-DSA
  sigGen and sigVer registrations
• replace the duplicated ML-DSA sigGen fixture with a fresh vector set covering
  keyGen, sigGen, and sigVer
• add an opt-in vector-set inventory check to prevent this coverage regression
  from recurring

Background

The existing ML-DSA request fixture contains the following vector sets:

• keyGen
• sigGen
• sigGen

The second and third vector sets are identical, so the end-to-end ACVP test no
longer exercises the Go sigVer translator, subprocess routing, or the
modulewrapper sigVer handler.

While regenerating the fixture, the current NIST Demo server rejected the
existing AWS-LC registration because the sigGen and sigVer capabilities did not
declare preHash and contextLength.

The modulewrapper already supports the pure signature interface and contexts
from 0 through 255 bytes, so the registration now declares:

• preHash: ["pure"]
• contextLength: 0..2040 bits, incrementing by 8

Vector provenance

The updated fixtures were generated from NIST Demo test session 763725 using
AWS-LC's registration payload and were answered by the AWS-LC modulewrapper.

vsId	Mode	Groups	Cases	Verdict
4021300	keyGen	3	75	passed
4021301	sigGen	9	135	passed
4021302	sigVer	9	135	passed

All three vector sets and the overall test session passed.

Regression guard

tests.json can now optionally specify an ExpectedVectorSets inventory.
The check compares the algorithm, mode, and revision as a multiset before
executing the fixture.

Only ML-DSA opts into the check in this change because it is the fixture with
the confirmed regression.

Review notes

I made two scope choices intentionally:

• ExpectedVectorSets is generic, but only ML-DSA opts into it in this change
  because this is the fixture with a confirmed inventory regression. If a
  broader fixture policy would be preferable, I would be happy to follow up
  separately rather than expand this PR.
• I kept the new session untrimmed to preserve the current keyGen and sigGen
  coverage density while restoring sigVer. If trimmed ACVP fixtures are
  preferred for repository size or maintenance reasons, I can regenerate both
  files with the existing trim_vectors.go workflow.

Testing

• rebuilt build_acvp_tool
• verified the generated registration capabilities
• ran the focused ML-DSA fixture comparison
• ran all 50 fixtures in tests.json
• ran go test ./util/fipstools/acvp/acvptool/...
• ran git diff --check

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[github-actions]

🔒 Security Review — View Report

Please review before merging.

[jakemas]

Verified locally:

• NIST’s published schema matches preHash:["pure"] and context range 0..2040.
• Rebuilt FIPS modulewrapper successfully.
• All 50 ACVP fixtures matched byte-for-byte.
• Go tests passed.
• ML-DSA coverage is 75 keyGen, 135 sigGen, and 135 sigVer cases.
• The inventory guard correctly represents the required three modes.

Regarding the new vectors:

Could you attach a redacted result artifact from NIST Demo session 763725 showing the passed session and per-vector-set verdicts for vsIds 4021300–4021302? The Demo API is bearer-token protected, so the session ID alone is not independently verifiable. Please do not share any access tokens.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.21%. Comparing base (1f371a8) to head (7a1b4f0).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3451      +/-   ##
==========================================
+ Coverage   78.01%   78.21%   +0.20%     
==========================================
  Files         699      699              
  Lines      124589   124591       +2     
  Branches    17286    17289       +3     
==========================================
+ Hits        97201    97453     +252     
+ Misses      26522    26269     -253     
- Partials      866      869       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jakemas]

@JunMin765677 Thank you for your contribution! To contribute to aws-lc you must include "By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license." at the end of your PR description, if you do, indeed agree to it! You can see other PRs for an example of this.

[JunMin765677]

Thanks for verifying this locally. Below is the requested redacted result artifact for NIST Demo session 763725. It retains only the session and per-vector-set verdict summaries; access tokens, request metadata, and individual test results are omitted.

{
  "artifact": "Redacted NIST ACVP Demo verdict summary",
  "testSessionId": 763725,
  "sessionPassed": true,
  "vectorSets": [
    {
      "vsId": 4021300,
      "mode": "keyGen",
      "disposition": "passed",
      "totalTests": 75,
      "passedTests": 75
    },
    {
      "vsId": 4021301,
      "mode": "sigGen",
      "disposition": "passed",
      "totalTests": 135,
      "passedTests": 135
    },
    {
      "vsId": 4021302,
      "mode": "sigVer",
      "disposition": "passed",
      "totalTests": 135,
      "passedTests": 135
    }
  ],
  "redaction": "Access tokens, request metadata, and individual test results omitted; only verdict summary fields retained."
}

SHA-256 of the redacted JSON artifact: f90408da3876dbf055abe40b0ed97b386a0c04f6746cb82f347f73b99dd2634f