fix(ci): DSPX-3499 skip PQC key config when platform lacks PQC support (#3594)

## Summary

When the xtest workflow calls `start-up-with-containers` with
`pqc-enabled: true` against an older platform ref (e.g. `v0.9.0`), the
platform crashes on startup:

```
open kas-xwing-private.pem: no such file or directory
```

**Root cause:** `init-temp-keys.sh` (from the `pqc-enabled` tag) runs
`go run ./service/cmd/keygen` to generate PQC key files, but older
platform versions don't have that command — so the key files are never
created. The action then unconditionally injects PQC
keyring/cryptoProvider entries pointing to those missing files.

Even if the files were somehow present, older platforms don't support
`hpqt:*` key types at all.

**Fix:** Guard all PQC configuration behind a `kas-xwing-private.pem`
file-existence check:

1. **`test/start-up-with-containers/action.yaml`**
- Split `hpqt:*` algorithms out of the `>= 0.7.1` version gate in "Map
the config to the keys" — only add them to `allowed_algorithms` when the
key files exist
- Add an early-exit guard in "Enable PQ" step that emits a `::warning`
and skips PQC config when key files are absent

2. **`test/start-additional-kas/action.yaml`**
- Override `PQC_ENABLED=false` before the yq command when key files
don't exist, so the `with(select(...))` block naturally skips PQC
entries

**Addresses:**
https://github.com/opentdf/platform/actions/runs/27224175116/job/80411765728?pr=3592

## Test plan

- [ ] Re-run the xtest matrix for `v0.9.0` — platform should start
successfully without PQC keys
- [ ] Verify `main` (or any PQC-capable ref) still gets PQC keys
configured as before
- [ ] Confirm `::warning` annotation appears in the Actions log for
older refs


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Enhanced automated testing workflows with improved validation checks
for cryptographic key files and platform-specific algorithm
compatibility, ensuring reliable test execution across deployment
scenarios and reducing configuration errors.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: CoopAgent <coopagent@users.noreply.github.com>

Author: dmihalcik-virtru

test/start-additional-kas/action.yaml

@@ -145,6 +145,11 @@ runs:
         LOG_TYPE: ${{ inputs.log-type }}
       with:
         run: |
+          # Disable PQC if key files weren't generated by the platform
+          if [[ "${PQC_ENABLED}" == "true" && ! -f kas-xwing-private.pem ]]; then
+            echo "PQC enabled but key files not found; disabling PQC for ${KAS_NAME}" 1>&2
+            export PQC_ENABLED=false
+          fi
           yq e '
             (.server.port = env(KAS_PORT))
             | (.mode = ["kas"])

test/start-up-with-containers/action.yaml

@@ -192,7 +192,12 @@ runs:
         allowed_algorithms=(ec:secp256r1 rsa:2048)
         if echo $PLATFORM_VERSION | awk -F. '{ if ($1 > 0 || ($1 == 0 && $2 > 7) || ($1 == 0 && $2 == 7 && $3 >= 1)) exit 0; else exit 1; }'; then
           # For versions 0.7.1 and later, we allow rsa:4096 ec:secp384r1 ec:secp521r1
-          allowed_algorithms+=(rsa:4096 ec:secp384r1 ec:secp521r1 hpqt:xwing hpqt:secp256r1-mlkem768 hpqt:secp384r1-mlkem1024)
+          allowed_algorithms+=(rsa:4096 ec:secp384r1 ec:secp521r1)
+        fi
+        # Only allow PQC algorithms if the platform generated PQC key files
+        if [[ ! -f kas-xwing-private.pem ]]; then
+          printf "PQC key files not found; skipping PQC configuration (platform may not support PQC key types)\n" 1>&2
+          exit 0
         fi
         keyring='[{"kid":"ec1","alg":"ec:secp256r1"},{"kid":"r1","alg":"rsa:2048"}]'
         keys='[{"kid":"e1","alg":"ec:secp256r1","private":"kas-ec-private.pem","cert":"kas-ec-cert.pem"},{"kid":"ec1","alg":"ec:secp256r1","private":"kas-ec-private.pem","cert":"kas-ec-cert.pem"},{"kid":"r1","alg":"rsa:2048","private":"kas-private.pem","cert":"kas-cert.pem"}]'
@@ -245,6 +250,10 @@ runs:
       shell: bash
       if: ${{ inputs.pqc-enabled == 'true' }}
       run: |
+        if [ ! -f kas-xwing-private.pem ]; then
+          echo "PQC key files not found; skipping PQC configuration (platform may not support PQC key types)" 1>&2
+          exit 0
+        fi
         yq e '
           (.services.kas.preview.hybrid_tdf_enabled = true)
           | (.services.kas.keyring += [{"kid":"x1","alg":"hpqt:xwing"},{"kid":"h1","alg":"hpqt:secp256r1-mlkem768"},{"kid":"h2","alg":"hpqt:secp384r1-mlkem1024"}])