zephyr: keep project CFLAGS off Zephyr internals

Forwarding mlkem-native CFLAGS into the Zephyr app build is intentional:
it keeps the Zephyr test and benchmark sources on the same warning policy
as the normal make build, including `-Werror`, `-Wpedantic`, `-Wconversion` and
`-Wsign-conversion`. Keep that behavior. The mlkem-native app sources still receive
the expanded flags explicitly through `ZEPHYR_TEST_CFLAGS`.

The failure was that the same flags also reached Zephyr's own CMake build
through the process environment. In the NUCLEO-N657X0-Q benchmark action,
the composed `--cflags="${inputs.cflags} ${inputs.archflags}"` becomes a
single space when both inputs are empty. scripts/tests treats that as a
non-empty value and exports `CFLAGS`. GNU make then appends mlkem-native's
default warning policy to `CFLAGS` and, because `CFLAGS` originated in the
environment, exports it to recipe children. CMake imports that environment
`CFLAGS` value into the global Zephyr build, so Zephyr internals such as
lib/heap/heap_constants.c are compiled under mlkem-native's pedantic
warning policy and fail with `-Werror`.

Do not weaken mlkem-native's flags, and do not stop forwarding them to the
Zephyr app. Instead, run the Zephyr CMake configure and build steps with
`CFLAGS`, `CXXFLAGS`, `CPPFLAGS` and `LDFLAGS` unset. This keeps the deliberate
strict policy on the mlkem/test sources via `ZEPHYR_TEST_CFLAGS` while leaving
Zephyr-controlled sources under Zephyr's own warning policy.

This did not fire in the Zephyr functional tests because that path passes an
empty `--cflags=""` value, together with `--no-auto`, so scripts/tests does not
export `CFLAGS`. The hardware benchmark path was different: its action always
joins cflags and archflags with a space, producing the non-empty " " case
that triggered the environment leak.

Signed-off-by: Brendan Moran <brendan.moran@arm.com>

Author: bremoran

test/zephyr/platform.mk

@@ -110,10 +110,13 @@ CFLAGS += -DNTESTS_FUNC=3 -DNTESTS_KAT=100 \
 # Requires AUTO=0 (see .github/workflows/zephyr.yml): the host-arch flags AUTO=1
 # adds must not reach the Zephyr toolchain, which selects the target arch itself.
 ZEPHYR_TEST_CFLAGS = $(subst \",\\\",$(patsubst -Imlkem,-I$(abspath mlkem),$(CFLAGS)))
+# Keep make-exported project flags out of Zephyr's own CMake build; the app
+# sources get those flags explicitly via ZEPHYR_TEST_CFLAGS.
+ZEPHYR_CMAKE_ENV := env -u CFLAGS -u CXXFLAGS -u CPPFLAGS -u LDFLAGS
 
 CUSTOM_BUILD = \
 	echo "  ZEPHYR  $(ZEPHYR_TARGET): $(notdir $@)" && \
-	cmake -GNinja -S $(ZEPHYR_APP) -B $(ZEPHYR_OUT) \
+	$(ZEPHYR_CMAKE_ENV) cmake -GNinja -S $(ZEPHYR_APP) -B $(ZEPHYR_OUT) \
 		-DBOARD=$(ZEPHYR_BOARD) \
 		-DZEPHYR_NATIVE_ROOT=$(CURDIR) \
 		-DZEPHYR_TEST_SRCS="$(strip $(TEST_SRCS))" \
@@ -123,7 +126,7 @@ CUSTOM_BUILD = \
 		$(ZEPHYR_TARGET_CMAKE_ARGS) \
 		-DUSER_CACHE_DIR=$(abspath $(ZEPHYR_OUT)/.cache) \
 		>/dev/null && \
-	cmake --build $(ZEPHYR_OUT) >/dev/null && \
+	$(ZEPHYR_CMAKE_ENV) cmake --build $(ZEPHYR_OUT) >/dev/null && \
 	cp $(ZEPHYR_OUT)/zephyr/zephyr.elf $@
 
 # A custom build links the test sources directly rather than from objects, so