CI: expand cross-platform smoke matrix (run tests; add 32-bit and big-endian coverage)

[the-sarge]

What to build

From the 2026-05-27 multi-agent code review (item M8; tracked as F5 in docs/code-review-followups-2026-05-28.md).

The cross-platform workflow currently runs only go build ./... and go vet ./... on macOS and Windows — no tests, no 32-bit targets, no big-endian targets. For a crypto library with byte-ordering-sensitive framing (LEB128, length-prefixed concatenation, fixed-size point/tag fields), build-only on two little-endian 64-bit OSes is a thin smoke test.

Expand the matrix:

• Run go test ./... on the existing macOS and Windows entries.
• Add a linux/s390x (big-endian) entry via QEMU running go test ./... — catches byte-order bugs.
• Add a linux/386 (32-bit) entry via QEMU running go test ./... — catches 32-bit int truncation bugs.
• If the QEMU runs prove flaky on the runner, mark them advisory/informational while the matrix stabilises.

Once 32-bit coverage lands, review item M5 (readLEB128 int accumulator widening) becomes a real bug detector rather than a defensive comment — note this relationship when implementing.

Acceptance criteria

• macOS and Windows matrix entries run go test ./... in addition to build/vet
• linux/s390x entry via QEMU runs go test ./...
• linux/386 entry via QEMU runs go test ./...
• If QEMU entries are advisory rather than gating, that status is documented in the workflow

Blocked by

None - can start immediately