Exposes the new det512 C API (n=512) as a parallel set of Det512-prefixed
types and functions alongside the existing unprefixed (det1024) bindings,
which remain unchanged. Mirrors the existing binding style.

New exports:
  - Constants: Det512PublicKeySize, Det512PrivateKeySize,
    Det512CurrentSaltVersion, Det512CTSignatureSize, Det512SignatureMaxSize,
    Det512N (= 512).
  - Types: Det512PublicKey, Det512PrivateKey, Det512CompressedSignature,
    Det512CTSignature.
  - Functions: Det512GenerateKey, Det512S1Coefficients,
    Det512HashToPointCoefficients.
  - Methods: Det512PrivateKey.SignCompressed;
    Det512CompressedSignature.{ConvertToCT, SaltVersion};
    Det512CTSignature.{SaltVersion, S2Coefficients};
    Det512PublicKey.{Verify, VerifyCTSignature, Coefficients}.

Adds Go tests mirroring the existing det1024 suite: TestKATs512 verifies
compressed signing against the reference known-answer vectors, TestDet512
covers the keygen/sign/verify round trip (compressed and CT), salt version,
bad-message and bad-key rejection, and h/c/s1/s2 coefficient recomputation,
plus signature-size, nil-message, distinct-seed, nil-signature, nil-seed,
and salt-version edge cases.

Harden length validation for compressed det1024 signatures

CI: add GHA build+test multi-platform workflow

The ~769 KiB sigs_ct array was a non-static tentative definition, so
clang emitted it as a common symbol and ld64 requested 32 KiB alignment
for it, exceeding the 16 KiB segment maximum on arm64 macOS:

  ld: warning: reducing alignment of section __DATA,__common from
  0x8000 to 0x4000 because it exceeds segment maximum alignment

The array is only used in this file, so make it static, which places it
in __bss with ordinary alignment and avoids the warning.

Add a couple of small length checks when working with compressed
det1024 signatures, and tidy up the ordering of the bounds check in
falcon_det1024_verify_compressed. Mirrors the existing checks on both
the C and Go sides.

falcon_det1024_convert_compressed_to_ct only checked that comp_decode
succeeded, not that it consumed the entire signature, so a valid
compressed signature with arbitrary trailing bytes would still convert
to a valid CT signature. Enforce exact consumption, matching the check
falcon_verify applies to compressed signatures.

Add tests covering the rejection paths for signatures too short to
contain a header and salt version, and for signatures with trailing
bytes, in both Verify and ConvertToCT.

Instantiate the template for the second Falcon parameter set, n = 512
(logn = 9), alongside the existing n = 1024 variant, without duplicating the
algorithm. Both variants are now generated from the one template,
deterministic.c.tmpl, so they cannot diverge.

  - deterministic.c.tmpl: add the DET_N == 512 parameter block; the algorithm
    body is unchanged and shared.
  - deterministic512.c: the generated n = 512 instantiation, with its own
    template rule mirroring deterministic1024.c so a plain "make" regenerates
    it when the template changes; the Makefile now builds it, "make gen" emits
    it, and "make check-gen" verifies it too.
  - deterministic.h: append the FALCON_DET512_* constants and falcon_det512_*
    declarations; the det1024 section is unchanged.
  - tests/test_deterministic512.c + tests/test_deterministic512_kat.h: a KAT
    runner and known-answer vectors for the n = 512 variant, mirroring the
    existing det1024 test, and wired into the CI workflow.
  - config.h: the determinism note now points at test_deterministic512 as well
    as test_deterministic1024; the det512 variant is just as sensitive to
    floating-point nondeterminism, so a porter should run its KATs too.

To confirm det1024 and det512 are the same algorithm, diff the two generated
files: `diff deterministic512.c deterministic1024.c`. The only differences are
the falcon_det1024_/falcon_det512_ prefixes and the FALCON_DET1024_/FALCON_DET512_
parameter macros. The two test runners are likewise identical bar those names:
`diff tests/test_deterministic1024.c tests/test_deterministic512.c` shows only
the prefix/macro differences -- the known-answer vectors themselves live in the
separate tests/test_deterministic{1024,512}_kat.h headers and are of course
distinct.

Introduce deterministic.c.tmpl and scripts/gen_deterministic.sh, and generate
deterministic1024.c from them instead of maintaining it by hand. This is a
mechanical change with no functional effect: the only change to the committed
deterministic1024.c is the one-line generated-from banner.

  - deterministic.c.tmpl: the Deterministic Falcon algorithm, parameterized by
    DET_N, which selects the falcon_det<n>_* function family and the matching
    parameter set.
  - scripts/gen_deterministic.sh: given a parameter n, expands the template's
    tabs so the indentation survives the C preprocessor, copies the #include
    prologue verbatim, runs the rest through the preprocessor with DET_N set to
    n, and restores the tab indentation with unexpand. It takes the n values to
    generate as arguments (the Makefile passes one at a time), so it has no
    built-in knowledge of which parameter sets exist.
  - Makefile: deterministic1024.c has a rule that regenerates it from the
    template whenever the template is newer, so editing the template and
    running a plain "make" can never compile a stale source. "make gen"
    regenerates unconditionally and "make check-gen" verifies the committed
    file is in sync with the template (for CI); both are marked .PHONY so a
    stray file of either name cannot satisfy the rule and silently skip the
    recipe. The script is deliberately not a prerequisite of the committed
    source: on a fresh clone git may check it out with a newer timestamp, and
    a plain "make" must never rewrite a committed file -- so run "make gen"
    after editing the script. A normal build just compiles the committed
    generated file.

The previous commit renamed the hand-written file to deterministic1024.c, so the
diff here shows it is byte-for-byte that file plus the banner -- i.e. the
template reproduces the existing code exactly.

Give the det1024 files the same explicit parameter suffix the forthcoming
det512 files will use:

  - deterministic.c -> deterministic1024.c
  - tests/test_deterministic.c -> tests/test_deterministic1024.c
  - tests/test_deterministic_kat.h -> tests/test_deterministic1024_kat.h

The Makefile targets, the CI workflow step, and the config.h reference are
updated to match, and the renamed test object rule gains its previously
missing dependency on the KAT header. No functional change.

Mechanical, no functional change. This rewrites deterministic.c into the
form that the build's code generator emits, so that the next commit can
generate it from a template without the resulting diff being swamped by
formatting noise:

  - the file-local convenience macros (FALCON_DET1024_TMPSIZE_*, the
    SALTED_SIG_* sizes) are expanded inline and their #define lines removed;
  - the "#define Q 12289" is hoisted to the top of the file;
  - one comment that hard-coded "1024" is made parameter-agnostic;
  - a handful of lines that were space-indented are normalized to tabs, so
    the file matches the tab indentation the generator emits (and the rest
    of the tree).

Verified that the full preprocessor output is identical to the previous
deterministic.c -- there is no functional change.

Review this commit with `git show -w` (ignore whitespace): the diff then
collapses to just the inlined macros, the hoisted Q, and the one reworded
comment, making clear the executable code is untouched.