nx_tls13_client_session_emit_finished.nx

nx_tls13_client_session_emit_finished.nx -- step 3c.4 of the nx_https_client wiring arc. Builds the client_Finished handshake message + wraps it in an AEAD-encrypted TLS record under the client handshake traffic key. Caller writes the resulting bytes to fd. After this primitive returns OK, the session is ready for step 3c.5 (derive application traffic keys; state -> CONNECTED). Composes 2 shipped primitives: tls13_client_emit_finished -- 36-byte Finished + transcript update (CRITICAL: appends CF to transcript so app-key derivation matches server's view) nx_tls13_record_encrypt -- ChaCha20-Poly1305 record wrap Pipeline: transcript_state at WAIT_CLIENT_FIN (covers CH..server_Finished) ↓ snapshot transcript_hash_CH..SF ↓ tls13_finished_key(client_hs_traffic_secret) -> finished_key ↓ HMAC(finished_key, transcript_hash) verify_data (32 bytes) ↓ wrap in handshake message: [HT_FINISHED][3-byte len=32][verify_data] client_Finished_msg (36 bytes) ↓ append to transcript (for app-key derivation hash) ↓ AEAD encrypt under client_hs_traffic_key + client_hs_iv + client_seq encrypted_record (5-byte header + 36+1 inner + 16-byte tag = 58 bytes) Caller calls sys_write(fd, record_bytes, record_len) to send. Public API: nx_tls13_client_session_emit_finished( session, out_buf, out_cap ) -> positive bytes-written | negative -NX_TLS13_EMIT_CF_* code nx_tls13_emit_cf_verdict_is_valid(v) -> 0|1 Sealed verdict: NX_TLS13_EMIT_CF_OK positive rc = bytes written