Add 32-bit CI job, fix sign-compare warnings in POSIX flash port

[yosuke-wolfssl]

Problem

No CI job builds or runs wolfHSM at 32-bit width, yet every supported port is
32-bit. The AES needed_size overflow class #487 only triggers at 32 bits, so it was
invisible to every gate. Adding a 32-bit job also surfaced width bugs in the
POSIX flash port that a 64-bit host silently hides.

Fix (port/posix/posix_flash_file.c)

• sign-compare: 5 off_t/ssize_t-vs-uint32_t comparisons that fail
  -Werror at 32 bits. The rc != size byte-count checks became
  (rc < 0) || ((size_t)rc != (size_t)size).
• MAX_OFFSET: now computed in uint64_t so the doubling can't wrap and the
  _Init comparisons stay unsigned at every width — avoids a signed narrowing
  that could take a large partition_size into ftruncate(<negative>).
• pfill(): returns an int status (0/-1) instead of a size_t count
  cast to ssize_t, which aliased negative above 2 GiB and tripped the new
  rc < 0 guard.

CI (.github/workflows/build-and-test-refactor.yml)

New ubuntu-only build-32bit job (gcc-multilib), parallel to the 64-bit matrix:

Step	Why
refactor default / SHE=1 DMA=1	size guards + DMA handlers at 32-bit
legacy test/ suite	only harness that runs POSIX_FLASH_FILE_CB; refactor uses the RAM sim
NOCRYPTO=1	distinct source set, skips wolfSSL

ARCHFLAGS is passed to make run too, so a stale rebuild can't switch arch mid-step.

Verification

64-bit and 32-bit (i386/QEMU) match exactly: default 43/26/0, SHE+DMA 53/16/0,
NOCRYPTO 16/53/0, legacy suite exit 0. Zero warnings, -Werror intact —
including the legacy tree's -Wpointer-arith, never compiled at 32-bit before.
Built against wolfSSL master tip, so no upstream -Werror relaxation is needed.
The legacy run executes posixFlashFile_* for the first time at 32-bit width;
a negative control (neutered pfill()) aborts that suite, confirming the step gates.

[Copilot]

Pull request overview

Adds a new 32-bit (-m32) GitHub Actions job to ensure wolfHSM is built/tested at the word size used by supported ports, and adjusts the POSIX flash-file backend to avoid 32-bit sign/width pitfalls surfaced by the new CI coverage.

Changes:

• Add a new Ubuntu-only build-32bit CI job that builds and runs both test-refactor targets and the legacy test/ suite under -m32.
• Fix several 32-bit sign-compare issues in posix_flash_file.c by making byte-count checks robust against ssize_t vs uint32_t comparisons.
• Rework MAX_OFFSET/pfill() typing to avoid wrap/narrowing issues and negative aliasing at larger sizes.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
port/posix/posix_flash_file.c	Adjusts offset/size handling and helper return types to behave correctly under 32-bit widths and -Werror.
.github/workflows/build-and-test-refactor.yml	Adds a dedicated 32-bit CI job that builds/runs refactor + legacy suites with ARCHFLAGS=-m32.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #491

Scan targets checked: wolfhsm-core-bugs, wolfhsm-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #491

Scan targets checked: wolfhsm-core-bugs, wolfhsm-src

No new issues found in the changed files. ✅

[bigbrett]

use constants from limits.h