Problem

In wh_Client_CryptoCbStd, the #ifdef HAVE_ED25519 block holding the
WC_PK_TYPE_ED25519_KEYGEN, _SIGN and _VERIFY cases was nested inside the
#ifdef HAVE_CURVE25519 block. These are independent wolfSSL build options, so
the three dispatch cases compiled only when both were defined.

With Ed25519 enabled and Curve25519 disabled, every Ed25519 operation on a
wolfHSM devId fell through to default: ret = CRYPTOCB_UNAVAILABLE;, which
wh_Client_CryptoCb deliberately propagates, so wolfCrypt silently used its
software implementation. For a key whose private scalar lives only in the HSM
(devCtx holds a keyId, no local material) that path cannot sign at all — HSM
offload broke with no diagnostic. The DMA sibling wh_Client_CryptoCbDma
already had the correct sibling layout, confirming the nesting was accidental.

Fix (src/wh_client_cryptocb.c)

Moved #endif /* HAVE_CURVE25519 */ up to just after the WC_PK_TYPE_CURVE25519
case so the Ed25519 group is a sibling rather than a child:

         } break;              /* end WC_PK_TYPE_CURVE25519 */
+#endif /* HAVE_CURVE25519 */
 
 #ifdef HAVE_ED25519
         ...
 #endif /* HAVE_ED25519 */
-#endif /* HAVE_CURVE25519 */

One line moved, net zero. Every other Curve25519/Ed25519 guard pair in the repo
was audited and is already correct. Closes f-7149.

Test harness

The existing Ed25519 tests did not catch this: they call the
wh_Client_Ed25519* APIs directly, bypassing the crypto callback, and the inline
test signs with a key that still holds local private material. The whole suite
passed with the dispatch cases compiled out.

• _whTest_CryptoEd25519CryptoCbHsmKey signs via wc_ed25519_sign_msg() on a
  key reduced to a bare keyId, so the callback must handle it; a software fallback
  returns BAD_FUNC_ARG. Pins the std path via wh_Client_SetDmaMode(ctx, 0) so
  the guard it protects cannot be masked by ambient DMA mode.
• NOCURVE25519=1 build knob in both harness Makefiles, gating
  HAVE_CURVE25519 in the shared test/config/user_settings.h.
• One CI row each in build-and-test-refactor.yml and build-and-test.yml.

Verification

Negative control on unfixed source: whTest_Crypto_Ed25519 fails rc=-173
(BAD_FUNC_ARG) in both NOCURVE25519 configs and passes with the fix,
isolating the defect to the guard. All builds clean under
-std=c90 -Werror -Wall -Wextra, ASan clean.

Intentionally not in this PR, both tracked as follow-ups: mandatory-dispatch
coverage for WC_PK_TYPE_ED25519_KEYGEN (needs WOLF_CRYPTO_CB_ONLY_ED25519,
which would also force the inline test's local-material sign through the
callback), and cryptocb-API coverage of the wh_Client_CryptoCbDma Ed25519 group.