tests/api/test_mldsa_legacy.c: fix bugprone-macro-parentheses in MLDSA_LEGACY_SIZE_ASSERT().

wolfssl/wolfcrypt/wc_mldsa.h: move WOLFSSL_MLDSA_NO_CTX setup to precede legacy dilithium.h header, so that the _NO_CTX remap macros are properly gated in.

Author: douzzer

tests/api/test_mldsa_legacy.c

@@ -89,7 +89,7 @@ wc_static_assert(sizeof(wc_dilithium_params) == sizeof(wc_MlDsaParams));
  * DILITHIUM_LEVEL{2,3,5}_*, DILITHIUM_ML_DSA_{44,65,87}_*) lives in its own
  * `#define` line in <dilithium.h>, so each is checked separately. */
 #define MLDSA_LEGACY_SIZE_ASSERT(LEGACY, CANONICAL) \
-    wc_static_assert(LEGACY == CANONICAL)
+    wc_static_assert((LEGACY) == (CANONICAL))
 
 /* LEVEL2 = ML-DSA-44 */
 MLDSA_LEGACY_SIZE_ASSERT(ML_DSA_LEVEL2_KEY_SIZE,           WC_MLDSA_44_KEY_SIZE);

wolfssl/wolfcrypt/wc_mldsa.h

@@ -54,6 +54,13 @@
     #include <wolfssl/wolfcrypt/cryptocb.h>
 #endif
 
+/* When WOLFSSL_MLDSA_FIPS204_DRAFT is enabled the legacy (pre-FIPS 204)
+ * no-context sign/verify API is required to handle draft-format signatures. */
+#if defined(WOLFSSL_MLDSA_FIPS204_DRAFT) && \
+    !defined(WOLFSSL_MLDSA_NO_CTX)
+    #define WOLFSSL_MLDSA_NO_CTX
+#endif
+
 /* TEMPORARY: pull in the legacy compatibility shim so its forward-arm
  * sub-config gate translation (legacy WOLFSSL_DILITHIUM_* /
  * WC_DILITHIUM_* -> canonical WOLFSSL_MLDSA_* / WC_MLDSA_*) and the
@@ -684,13 +691,6 @@ struct wc_MlDsaKey {
 #endif
 #endif
 
-/* When WOLFSSL_MLDSA_FIPS204_DRAFT is enabled the legacy (pre-FIPS 204)
- * no-context sign/verify API is required to handle draft-format signatures. */
-#if defined(WOLFSSL_MLDSA_FIPS204_DRAFT) && \
-    !defined(WOLFSSL_MLDSA_NO_CTX)
-    #define WOLFSSL_MLDSA_NO_CTX
-#endif
-
 /* Functions */
 
 #ifndef WOLFSSL_MLDSA_VERIFY_ONLY