CI unblock: DER standalone target, SHA KAT, and streaming SHA-256 fixes

[shrec]

What

• Added STANDALONE_TEST to test_exploit_ecdsa_der_confusion_standalone, which fixes the missing main link failure in CI.
• Hardened batch_z_inv() allocation guarding so impossible oversize requests fail safely without exceptions in -fno-exceptions builds.
• Reworked the SHA-256 million-a KAT to use exact 64-byte blocks and pinned streaming SHA256 class compression to the scalar path on x86 after reproducing an incorrect digest on long full-block streams via the SHA-NI route.
• Kept fixed-size hot paths (sha256_32 / sha256_33) accelerated, so the correctness fix is narrowly scoped to the streaming class path.

Numbers

• test_exploit_sha_kat_standalone: 17 passed, 0 failed
• test_exploit_ecdsa_der_confusion_standalone: 12 passed, 0 failed

How to get it

• Branch: dev
• Commit: 55d5dd62 (Fix CI-blocking audit and SHA regressions)