Fix 4 Coverity findings (fwTPM PolicyNV, listen socket, secret_seal)

[aidangarske]

Fixes four genuine Coverity findings from the latest scan. The remaining 19 outstanding CIDs were reviewed and dismissed as false positives (config-dependent dead-branch templates, and TPM/file values already bounded or MAC-authenticated before use).

Fixes

• CID 909308 FwCmd_PolicyNV (src/fwtpm/fwtpm_command.c) — logically dead error-cleanup. The if (hashCtxInit) wc_HashFree(...) block was unreachable because the intermediate wc_HashUpdate/wc_HashFinal return codes were ignored, so rc could never become non-zero between init and the inline free. Now every hash return is checked and the free is deferred on failure, making the bottom cleanup live and closing the unchecked-return gap.
• CID 909295 CreateListenSocket (src/fwtpm/fwtpm_io.c) — unchecked setsockopt(SO_REUSEADDR) return. Checked with a non-fatal DEBUG_WOLFTPM-gated diagnostic (the option is advisory).
• CID 483395 TPM2_Boot_SecretSeal_Example (examples/boot/secret_seal.c) — improper use of negative value. hexToByte() returns -1 on malformed hex, which wrapped into word32 secretSz as 0xFFFFFFFF; the secretSz <= 0 guard could not catch it, leading to an over-read. Now captured in an int and rejected when negative.
• CID 483392 TPM2_Boot_SecretSeal_Example (examples/boot/secret_seal.c) — logically dead code. policyFile defaulted to "policyauth.bin", so the -publickey= branch (a documented README example) was unreachable. Default is now NULL, matching the publicKeyFile sibling, so all branches are reachable.

Testing

All three modified files pass gcc -fsyntax-only.