feat(tbor): implement HmacGenerateKey + Hmac (masked-key HMAC crypto)

[vsonims]

Summary

Adds the TBOR HMAC crypto command pair, stacked on top of the
RSA-AES key-unwrap commands (#583).

Reordered stack: this PR now sits above the key-unwrap PR (#583).
It reuses the shared session/masking helpers and the shared HashAlgo
wire enum introduced by #583, so this layer is purely the HMAC command
surface.

HmacGenerateKey (opcode 0x11)

Generate a fresh random HMAC key of the caller-selected SHA variant
(SHA-256/384/512 → 32/48/64 B) and return it masked (AEAD-GCM-256)
under the requested scope's masking key. The key is not stored
on-device; the caller holds the masked blob (unmask-on-use).

Hmac (opcode 0x12)

Compute an HMAC tag over a host-supplied message using a caller-held
masked HMAC key, unmasked on-device for the operation and then
discarded.

Wiring

Both opcodes are routed through the fw dispatcher, the is_known_opcode
/ is_in_session / needs_session_id_cross_check classifiers, and
op::SessionCtrl::from_tbor_opcode (InSession, CO/CU).

Tests / validation

• Emu: keygen round-trip across all hashes/scopes, MAC round-trip,
  tamper-reject, scope/hash rejects.
• Full TBOR emu suite green (126 tests at this layer); clippy clean;
  nightly fmt + copyright clean; Uno (thumbv7em) build passes.
• Docs: docs/tbor-ddi/commands/{hmac_generate_key,hmac}.md + README
  rows (0x11, 0x12).

[vsonims]

Update (rebased on #583): HmacGenerateKey now uses the encoder's reserve + fill support from #583 — the masked-blob length is fixed by the SHA variant, so the handler reserves the response slot up front and masks the generated key straight into it (masked_key_reserve + decode_mut), with no scratch buffer and no copy.

[Copilot]

Pull request overview

This PR adds two new TBOR crypto commands to the firmware + host stack: HmacGenerateKey (generate a caller-held masked HMAC key) and Hmac (unmask-on-use to compute an HMAC tag), building on the masked-key infrastructure and shared HashAlgo enum introduced by the RSA-AES unwrap layer.

Changes:

• Add new TBOR opcodes 0x11 (HmacGenerateKey) and 0x12 (Hmac) to dispatcher routing, session classification, and SessionCtrl::from_tbor_opcode.
• Implement firmware handlers to generate/mask variable-length HMAC keys and to unmask+MAC a host-provided message.
• Add wire schemas, host-side wrappers, emulator integration tests, and command documentation for both opcodes.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
fw/core/lib/src/op.rs	Marks HMAC_GENERATE_KEY/HMAC as InSession in SessionCtrl::from_tbor_opcode.
fw/core/lib/src/ddi/tbor/mod.rs	Adds modules, opcode constants, dispatcher routing, and opcode classifiers for 0x11/0x12.
fw/core/lib/src/ddi/tbor/hmac.rs	New firmware handler for Hmac (unmask-on-use and compute tag).
fw/core/lib/src/ddi/tbor/hmac_generate_key.rs	New firmware handler for HmacGenerateKey (generate key and mask into response).
fw/core/ddi/tbor/types/src/lib.rs	Exposes new firmware-side TBOR type modules/exports.
fw/core/ddi/tbor/types/src/hmac.rs	New firmware-side TBOR wire schema for Hmac.
fw/core/ddi/tbor/types/src/hmac_generate_key.rs	New firmware-side TBOR wire schema for HmacGenerateKey.
docs/tbor-ddi/README.md	Adds command table entries for 0x11/0x12.
docs/tbor-ddi/commands/hmac.md	New command documentation for Hmac.
docs/tbor-ddi/commands/hmac_generate_key.md	New command documentation for HmacGenerateKey.
ddi/tbor/types/tests/commands/mod.rs	Registers new emu integration test modules.
ddi/tbor/types/tests/commands/hmac.rs	New emu integration tests for MAC operation and unwrap→MAC integration.
ddi/tbor/types/tests/commands/hmac_generate_key.rs	New emu integration tests for keygen across hashes/scopes/lengths and failure cases.
ddi/tbor/types/src/lib.rs	Exposes new host-side TBOR wrapper modules/exports.
ddi/tbor/types/src/hmac.rs	New host-side wrapper types for Hmac.
ddi/tbor/types/src/hmac_generate_key.rs	New host-side wrapper types/constants for HmacGenerateKey.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

fw/core/lib/src/ddi/tbor/hmac_generate_key.rs:167

• resolve_masking_key is called after generating the random key. For scopes that are unavailable (e.g., SecurityDomain before CreateSD, or Session on PALs that don't support per-session masking), this still consumes RNG / creates key material before failing. Since the module docs state unavailable scopes should fail before any key is generated, resolve the masking key first and only then allocate/generate the key.

            // Generate the random HMAC key into scratch.
            let key_buf = alloc.dma_alloc(key_len)?;
            pal.hmac_gen_key(io, algo, key_buf).await?;

            let masking_key = resolve_masking_key(pal, io, scope, sess_id)?;