nx_tls13_client_dispatch_with_validation_test.nx

nx_tls13_client_dispatch_with_validation_test.nx -- KAT for the dispatcher variant that enforces cert validation at WAIT_CERT. We exercise the WRAPPER's contract: - non-WAIT_CERT states delegate to the underlying dispatcher (we test by feeding a malformed message at WAIT_EE and expecting BAD_MSG_TYPE -- proves delegation works) - WAIT_CERT with empty trust store -> CERT_VERIFY_FAIL (cert validation rejects because no trust anchor matches) - WAIT_CERT with malformed cert msg -> CERT_VERIFY_FAIL (the bridge rejects before validation even starts) - sealed verdict gate The full happy-path (handshake complete with cert valid) is proven by nx_https_pipeline_e2e_test for the cert pipeline; the bridge KAT proved the verdict routing; this KAT proves the dispatcher integration. expect_exit: 0 license_tier: ORIGINAL