CI: Add config variation for MLK_CONFIG_NO_RANDOMIZED_API

The deterministic-only build (MLK_CONFIG_NO_RANDOMIZED_API) had no
coverage in the config-variations matrix, which is how the test_mlkem.c
build regression went unnoticed.

Add a "no-randomized" variation that builds and runs func, kat, acvp,
wycheproof, stack and rng_fail under the flag, mirroring the reduced-API
entries. Examples are included except basic_deterministic, which already
sets the flag in its own config and would otherwise trip -Wmacro-redefined.
The alloc test is disabled: its exact high-watermark check assumes the
randomized wrappers, whose coins buffer is absent from the
deterministic-only allocation profile.

Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>

Author: hanno-becker

.github/actions/config-variations/action.yml

@@ -11,7 +11,8 @@ inputs:
     description: 'List of tests to run (space-separated IDs) or "all" for all tests. Available IDs: pct-enabled,
     pct-enabled-broken, custom-alloc-heap, custom-zeroize, native-cap-ON, native-cap-OFF, native-cap-ID_AA64PFR1_EL1,
     native-cap-CPUID_AVX2, no-asm, serial-fips202, custom-randombytes, custom-memcpy, custom-memset, custom-stdlib,
-    nblocks-1, nblocks-2, nblocks-4, keygen-only, encaps-only, decaps-only, keygen-encaps, keygen-decaps, encaps-decaps'
+    nblocks-1, nblocks-2, nblocks-4, keygen-only, encaps-only, decaps-only, keygen-encaps, keygen-decaps, encaps-decaps,
+    no-randomized'
     required: false
     default: 'all'
   opt:
@@ -366,3 +367,26 @@ runs:
         rng_fail: true
         opt: ${{ inputs.opt }}
         examples: true
+    - name: "No randomized API (deterministic only)"
+      if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'no-randomized') }}
+      uses: ./.github/actions/multi-functest
+      with:
+        gh_token: ${{ inputs.gh_token }}
+        compile_mode: native
+        cflags: "-DMLK_CONFIG_NO_RANDOMIZED_API -fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all"
+        ldflags: "-fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all"
+        func: true
+        kat: true
+        acvp: true
+        wycheproof: true
+        stack: true
+        rng_fail: true
+        opt: ${{ inputs.opt }}
+        examples: true
+        # basic_deterministic sets MLK_CONFIG_NO_RANDOMIZED_API in its own config,
+        # so passing it again on the command line is a macro redefinition.
+        extra_args: "--exclude-example basic_deterministic"
+        # The alloc test's exact high-watermark check assumes the randomized
+        # wrappers (which allocate the coins buffer), so it doesn't match the
+        # deterministic-only allocation profile.
+        alloc: false