fix(sample_ntt,sha3): FIPS-203 SHAKE-128 squeeze + self-checking sha3 TBs

sample_ntt was non-conformant: both RTL and the test reference re-ran
keccak_p after every 3-byte squeeze instead of consuming the full
1344-bit SHAKE-128 rate. Only coeff[0] matched a standard sampler, so
the generated A matrix would not interoperate with any compliant ML-KEM.

- sample_ntt_sync{,_shared}.v: walk all 56 groups of the rate block via
  grp_ptr_r; re-permute only when the block is exhausted. Verified
  256/256 against ml-kem-r Rust sample_ntt on two seeds, and 1536/1536
  in the Verilator framework (runtime ~128x faster per poly).
- gen_vectors.py: use a self-contained hashlib.shake_128 oracle.

sha3 testbench fixes (all now self-check hash_o against verified vectors,
cross-checked with hashlib and ml-kem-r mlkem_G):
- tb_sha3_xsim_simple.v: test G/H/J modes, not just G.
- tb_keccak_core_xsim.v: correct the wrong EXPECTED_STATE constant
  (RTL was correct; lane0 = 0xf1258f7940e1dde7 per FIPS 202).
- tb_sha3_xsim.v: read expected file and self-check per vector; add
  vectors/g_basic_{input,expected}.hex (3 G / 2 H / 2 J).

Remove stale sha3_chain test (its RTL was deleted in 1cace51) and its
README references. Extend .gitignore for XSIM artifacts and result dumps.

test_framework/modules/sample_ntt/gen_vectors.py

@@ -1,9 +1,11 @@
 """gen_vectors.py - Test vector generator for sample_ntt module.
 
-Generates random rho seeds, calls the Python reference sampleNTT to compute
-expected coefficients, and writes hex files for Verilator simulation.
+Generates random rho seeds, computes expected coefficients with a standard
+FIPS 202 SHAKE-128 rejection sampler (hashlib), and writes hex files for
+Verilator simulation.
 
-Matches the Python reference (sample.py / SHA_3.py) bit-exactly.
+The expected coefficients are FIPS-203-conformant (Algorithm 7 SampleNTT):
+SHAKE-128(rho || j || i), consume the full rate, 12-bit rejection sampling.
 """
 
 import os
@@ -11,21 +13,36 @@ import random
 import sys
 import hashlib
 
-# Add the Python reference implementation to path
-_REF_DIR = os.path.expanduser(
-    "~/Dev/server_code/python_project/PQC_2025/A_ML_KEM_v0"
-)
-if _REF_DIR not in sys.path:
-    sys.path.insert(0, _REF_DIR)
-
-import utils
-import sample as sample_ref
-
 # Add test_framework/lib to path for VectorGenerator base class
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "lib"))
 from vector_gen import VectorGenerator
 
 
+def _sample_ntt_ref(seed: bytes) -> list[int]:
+    """FIPS 203 Algorithm 7 SampleNTT using standard SHAKE-128.
+
+    Args:
+        seed: 34-byte input = rho(32) || j(1) || i(1).
+
+    Returns:
+        List of 256 coefficients in [0, 3329).
+    """
+    # 1344 bytes = 8 full SHAKE-128 rate blocks; ample for 256 accepts.
+    stream = hashlib.shake_128(seed).digest(1344)
+    coeffs = []
+    off = 0
+    while len(coeffs) < 256:
+        c0, c1, c2 = stream[off], stream[off + 1], stream[off + 2]
+        off += 3
+        d1 = c0 | ((c1 & 0x0F) << 8)
+        d2 = (c1 >> 4) | (c2 << 4)
+        if d1 < 3329:
+            coeffs.append(d1)
+        if d2 < 3329 and len(coeffs) < 256:
+            coeffs.append(d2)
+    return coeffs
+
+
 class SampleNTTVectorGenerator(VectorGenerator):
     """Generates test vectors for the sample_ntt_sync module."""
 
@@ -40,25 +57,21 @@ class SampleNTTVectorGenerator(VectorGenerator):
         """
         k = params.get("k", 2)
 
-        # Generate random 32-byte rho (as binary string, matching the reference)
-        rho_bin = utils.random_Generator(8 * 32)  # 256-bit binary string
+        # Random 32-byte rho
+        rho = bytes(random.randint(0, 255) for _ in range(32))
 
         # Choose random (i, j) indices within [0, k-1]
         i = random.randint(0, k - 1)
         j = random.randint(0, k - 1)
 
-        # Build the 34-byte input for sampleNTT: rho || j || i
-        # Each component is a binary string (LSB at index 0)
-        s_j_bin = utils.dec_to_binary_little_endian(j)  # 8-bit binary string
-        s_i_bin = utils.dec_to_binary_little_endian(i)  # 8-bit binary string
-        B = rho_bin + s_j_bin + s_i_bin  # 272-bit binary string
+        # 34-byte SampleNTT input: rho || j || i (FIPS 203 Alg 13/7)
+        seed = rho + bytes([j]) + bytes([i])
 
-        # Compute expected coefficients using Python reference
-        coeffs = sample_ref.sampleNTT(B)  # numpy array of 256 ints
+        # Expected coefficients from a standard SHAKE-128 sampler
+        coeffs = _sample_ntt_ref(seed)
 
-        # Convert rho to hex for the input file
-        # binary_to_hex_little_endian produces MSB-first hex per byte
-        rho_hex = utils.binary_to_hex_little_endian(rho_bin)
+        # rho hex: byte 0 first (matches TB parse_rho byte ordering)
+        rho_hex = rho.hex().upper()
 
         return {
             "input": {