[Repo Assist] feat: add l_hmac_sha256 — HMAC-SHA-256 message authentication

[github-actions]

🤖 This is an automated PR from Repo Assist.

Summary

Adds l_hmac_sha256() as a companion to the existing l_sha256 family. HMAC-SHA-256 (RFC 2104) is the industry-standard message authentication primitive — useful for cookie signing, API authentication, token generation, and TLS helpers.

API addition:

/// One-shot HMAC-SHA256. Authenticates datalen bytes using keylen-byte key; writes 32-byte tag.
static inline void l_hmac_sha256(const void *key, size_t keylen,
                                  const void *data, size_t datalen,
                                  unsigned char hash[32]);

Implementation

Follows RFC 2104:

• Keys longer than the SHA-256 block size (64 bytes) are pre-hashed first
• Inner digest: H(ipad ⊕ K ∥ message)
• Outer digest: H(opad ⊕ K ∥ inner)
• Zero heap allocation — two 64-byte stack arrays, one reused L_Sha256 context

Tests

Added test_hmac_sha256() in tests/test_utils.c with three vectors cross-verified against Python hmac and OpenSSL:

TC	Key	Data
TC1	20 × 0x0b	"Hi There"
TC2	"Jefe"	"what do ya want for nothing?"
TC5	131 × 0xaa (> block size, exercises key-hashing path)	"Test Using Larger Than Block-Size Key..."

Test Status

✅ Local Linux (gcc): bash Taskfile test

• test_utils: 271/271 tests passed (24 new HMAC-SHA-256 assertions)
• All other suites: PASS
• No warnings with -Wall -Wextra -Wpedantic

Generated by 🌈 Repo Assist at {run-started}. Learn more.

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@1f672aef974f4246124860fc532f82fe8a93a57e