nx_tls13_client_dispatch_with_validation.nx

nx_tls13_client_dispatch_with_validation.nx -- TLS 1.3 client dispatcher variant that enforces cert chain validation against a TrustStore at the WAIT_CERT state. Phase 0b §L sub-4 of the TLS client arc. Wraps the existing tls13_client_dispatch_handshake_message (commit pre-dating this session, with the "accept ANY cert" STUB intentionally documented in its preamble) with the cert-validation BRIDGE shipped this session (nx_tls13_client_validate_certificate, commit c5ddbf81). Wrapper protocol: - For state != WAIT_CERT: delegate unchanged to the underlying dispatcher (transcript update + state transition unchanged). - For state == WAIT_CERT: call the bridge FIRST against the Certificate message bytes. If validation fails, return CERT_VERIFY_FAIL (no transcript update, no state advance -- handshake stalls until caller closes the connection). If validation succeeds, delegate to the underlying dispatcher (which advances state to WAIT_CV). Per Cardinal 19 (API contract stability): the existing dispatcher signature is UNCHANGED. Callers without a TrustStore (e.g. the loopback test that uses a self-signed throwaway) keep working in the legacy "accept any" mode. The real Web PKI client uses this variant. Per Cardinal 12 (defensive at boundaries): cert validation happens BEFORE the underlying dispatcher's transcript update, so a rejected cert doesn't poison the transcript hash. Public API: tls13_client_dispatch_with_validation( state, msg, msg_len, server_hs_traffic_secret, transcript_state, out_new_state, val_ctx: *TlsValidationContext ) -> verdict nx_tls13_dwv_verdict_is_valid(v) -> 0|1