fix: 两个失败种子的最后一个矩阵多项式 A[1][1] 都恰好在第 3 个 SHAKE rate block 的最后一个 3-byte group（第 168 组）产出第 256 个系数。当前 RTL 在该

系数已经完成后仍启动一次多余的 Keccak 重排；顶层随即切换到 CBD 阶段，共享 core 的这份旧结果被 CBD 当成自己的结果接收，所以后续 KeyGen 全错。我要在两个
  SampleNTT 变体中阻止“第 256 个系数已经是本组 d2”时的重排

sync_rtl/sample_ntt/sample_ntt_sync.v

@@ -210,6 +210,10 @@ module sample_ntt_sync #(parameter K = 4) (
     // d2 rejected, no longer need coefficients, or d2 was just accepted out.
     wire grp_done = (state_r == ST_SQUEEZE) && (sq_phase_r == 2'd2) &&
                     (!d2_acc_r || !need_more || (valid_o_r && ready_i));
+    // `need_more` observes the registered counter before the final d2
+    // handshake increments it. Detect that boundary explicitly so a full
+    // rate block does not launch an unnecessary final re-permutation.
+    wire completes_output = valid_o_r && ready_i && (coeff_cnt_r == 9'd255);
 
     // ================================================================
     // FSM: state_next (combinational)
@@ -235,7 +239,7 @@ module sample_ntt_sync #(parameter K = 4) (
                 // next group in this block, re-permute (block exhausted), or
                 // finish.
                 if (grp_done) begin
-                    if (!need_more)
+                    if (!need_more || completes_output)
                         state_next = ST_DONE;
                     else if (grp_ptr_r < GRP_MAX)
                         state_next = ST_SQUEEZE;  // next group, no re-permute