[dgarske]

Description

Two commits: the hybrid signing fixes first, then the SAMD21 target that depends on them.

hybrid: fix LMS/XMSS keystore import and PQ secondary builds

A hybrid LMS or XMSS image never verified. The LMS and XMSS verify paths imported the public key at KEYSTORE_PUBKEY_SIZE, the keystore slot width, but a universal keystore sizes every slot for the widest algorithm in the build, so the key arrived padded and the import rejected it. The ML-DSA path already asked the key for its own length.

Three related problems came from the same assumption that the primary algorithm describes the whole keystore: a classic primary with a post-quantum secondary defined wolfBoot_verify_signature_primary twice and did not build, the slot width and the stack ceiling followed the primary alone, and keygen -i mistook slot padding for a DER header when reading the first public key back out.

Also fixed: an LMS key could not produce a second signature in one run, which a delta image needs for its own header, because the callback setters and wc_LmsKey_Reload() reject a key that is already working. And the manifest is now sized from its contents for every image rather than only when a certificate chain, custom TLV or DTS is present, with the delta path resolving the same growth before it computes the inverse-patch offset.

samd21: add example configs, SERCOM console and NVMCTRL fixes

hal/samr21.c is a SAM D21 HAL, clocked for a SAMD21G18A at 48MHz, but nothing could reach it: no example config, no docs, no CI build. Adds samd21.config, samd21_j18.config and samd21_j18_hybrid.config (LMS plus ECDSA P-256), a SERCOM console, a docs/Targets.md section, CI jobs, and wolfBoot_success() in the test app so an A/B update confirms instead of rolling back. WOLFBOOT_RAM_SIZE is now a linker substitution, as the script hardcoded 16KB and capped the 32KB parts. Both layouts use a 32KB bootloader region, the largest the NVMCTRL BOOTPROT fuse can protect.

HAL fixes: hal_init() and hal_prepare_boot() cleared APBBMASK.NVMCTRL, set out of reset, gating the flash controller's clock off before any write or erase; PAC_WP_NVMCTL was the DSU bit, where NVMCTRL is peripheral 34 against PAC1's base 32, so bit 2; hal_flash_write() issued one page-write per transfer and now sets CTRLB.MANW and commits each page; and write and erase always returned success, where they now report NVMCTRL.STATUS errors.

Testing

Simulator: both orderings of LMS and XMSS against ECC256, ML-DSA as a secondary, and an LMS delta image whose inverse-patch offset tracks the grown header. sim-lms, sim-xmss, sim-ml-dsa-ecc-hybrid and sim.config are unchanged, and the unit tests pass.

SAMD21 is not validated on hardware; the console pinout is from the Xplained Pro schematic. All three configs build, and unit-samr21-erase-advance and unit-flash-write-samr21 cover the erase stride, a multi-page write and the error returns.