frost_enrollment: correct the zeroing contract and harden the CI guard

The two findings from the second review round, plus the coverage gap and
comment error it noted.

Finding 8: the zeroing exception was narrower in the docs than in the
code.

  The previous commit's fix leaves shares32_out untouched on EVERY
  params_are_valid rejection -- duplicate ids, threshold < 2, new_id
  among the helpers, an id >= n, the mode bounds -- but the header
  scoped the exception to "when n_ids itself is out of range", and
  frost_enrollment.md still said flatly that outputs are zeroed on every
  failure path. A caller who inspects the buffer after a failed call
  would, on a duplicate-id or t = 1 rejection, read whatever was there
  before. In this protocol that can be additive shares of a secret from
  an earlier call.

  Both now state the actual invariant: not written when the parameter
  tuple is rejected, because its extent is only known to be u*32 once
  n_ids has been validated against the rest of the tuple; zeroed on
  every failure found after that point (an unusable thresh_pk, my_id not
  among the helpers, an invalid secret share). The .md adds the sentence
  a defensive caller needs: treat a rejected tuple as leaving the buffer
  unmodified, not as leaving it zeroed. Documentation only -- the
  implementation and the tests already agreed with this reading.

Finding 9: the new CMake CI step never checked that the modules landed.

  It configured, built and installed with all five module flags, then
  ran `ls -RlAh` -- which prints and does not assert -- and linked
  examples/ecdsa.c, which uses core symbols only. Deleting the
  add_compile_definitions or PUBLIC_HEADER line for a module during an
  upstream sync would keep the step green: no module code means no
  undefined references, and the install simply omits the header. The
  guard added one commit ago caught a MISORDERED block but not a
  MISSING one.

  The step now asserts both halves. `ls` of all five module headers
  fails the step under bash -e if any is absent, and
  examples/frost_enrollment.c is compiled and run against the installed
  library, which no header-only check would cover -- it needs the
  symbols to actually be in the library.

  Verified by running the step's exact command sequence under bash -e:
  it exits 0 as written, and against an install configured WITHOUT the
  modules the header assertion exits 2 and the example fails to compile
  on the missing include.

Coverage: the params-hash attribution path was still only tested where
identifier equals index. The previous commit pinned identifier
semantics for the scalar-overflow path on helper set {0, 2}, but
share_agg's other `*mismatch_id = ids[i]` -- the parameters-hash
disagreement -- was exercised only on {0, 1}. It is now pinned on
{1, 3}, corrupting each slot in turn so the mapping is fixed at both
ends: index 0 must report 1, index 1 must report 3. Verified
load-bearing by changing the assignment to `(uint32_t)i`, which fails
the new case.

Comment error: the {0, 2} overflow case carried the claim that it would
catch an implementation returning array indices. It would not -- it
corrupts slot 0, whose identifier is also 0. The discrimination comes
from the paired own-slot case at slot 1 (identifier 2), and the comment
now says so.

Correcting the record rather than rewriting it: commit 69766dd3's
message says the suite goes "from 12 cases to 16" with "six new tests".
Both counts are wrong. The contract test landed in 266c6a7c, so the
table went 13 -> 17, and that commit added four cases (api, infinity,
no_side_effects, max_size) alongside the x = 0 addition to an existing
test and the two de-confoundings. The commits are unpushed and could be
amended, but the review cites them by hash, so the numbers are corrected
here instead. With this commit the module has 17 tests.

Verification: warning-free build; 17/17 at -i=16, -i=200 and -i=1000;
./tests, ./noverify_tests and ./exhaustive_tests exit 0; `make check`
12/12; the module clean under valgrind (0 errors from 0 contexts);
ctime_tests clean under valgrind; CMake ctest 542/542; vectors.h still
regenerates byte for byte, so nothing here touched a frozen encoding.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

include/secp256k1_frost_enrollment.h

@@ -172,10 +172,11 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_frost_enrollment_params
  *  Returns: 0 if the arguments are invalid, 1 otherwise
  *  Args:            ctx: pointer to a context object
  *  Out:    shares32_out: pointer to an array of u*32 bytes for the enrollment
- *                        shares, aligned with `ids`. Zeroed if this function
- *                        returns 0 -- except when n_ids itself is out of
- *                        range, in which case the buffer is not written at
- *                        all, since its size is not known to be u*32.
+ *                        shares, aligned with `ids`. Not written at all when
+ *                        the parameter tuple is rejected, since its extent is
+ *                        only known to be u*32 once n_ids has been validated
+ *                        against the rest of the tuple; zeroed on every
+ *                        failure detected after that point.
  *      params_hash32_out: pointer to a 32-byte array for the parameters hash,
  *                        identical to what
  *                        `secp256k1_frost_enrollment_params_hash` returns for