nx_tls13_client_session_emit_finished_test.nx

nx_tls13_client_session_emit_finished_test.nx -- KAT for step 3c.4: emit + encrypt client Finished. Full happy-path of the underlying tls13_client_emit_finished + nx_tls13_record_encrypt round-trip is proven by the shipped nx_tls13_loopback_test. This KAT verifies the WRAPPER's contract surface: - state guards (must be at WAIT_CLIENT_FIN) - buf-overflow guard (need at least 58 bytes) - client_seq increments on every call - state advances to WAIT_APP_KEYS on success, preserved on state-guard failure - sealed verdict gate expect_exit: 0 license_tier: ORIGINAL