nx_tls13_client_session_recv_sh.nx

nx_tls13_client_session_recv_sh.nx -- step 3c.2 of the nx_https_client wiring arc. Consumes the bytes of a TLS 1.3 ServerHello handshake message (provided by the caller -- this step doesn't do fd IO; that's the orchestrator wrapper 3c.6 in a later commit) and walks the full handshake-key-derivation cascade: 1. Parse the ServerHello message (via shipped tls13_server_hello_parse) 2. Find the key_share extension + extract server's X25519 pubkey 3. Compute shared_secret = x25519(my_priv, server_pub) 4. Run TLS 1.3 key schedule cascade (RFC 8446 §7.1): early_secret = HKDF-Extract(0, 0) derived_1 = Derive-Secret(early, "derived", "") handshake_secret = HKDF-Extract(derived_1, shared_secret) 5. Feed ServerHello bytes into transcript (so H1 = hash(CH || SH)) 6. Snapshot transcript -> H1 7. Derive c_hs_traffic_secret + s_hs_traffic_secret using H1 8. Expand each into AEAD key (32B) + IV (12B for ChaCha20-Poly1305 or AES-GCM) 9. Reset per-direction sequence numbers to 0 10. Advance state CH_SENT -> WAIT_EE After this primitive returns OK, the session is ready for the 3c.3 step (recv encrypted handshake records, decrypt with server_hs_traffic_key, dispatch via tls13_client_dispatch_with_validation). Public API: nx_tls13_client_session_recv_sh(session, sh_bytes, sh_len) -> verdict nx_tls13_recv_sh_verdict_is_valid(v) -> 0|1 Sealed verdict enum: NX_TLS13_RECV_SH_OK keys derived, state advanced NX_TLS13_RECV_SH_BAD_STATE session not in CH_SENT NX_TLS13_RECV_SH_BAD_FORMAT SH parse failed NX_TLS13_RECV_SH_NO_KEYSHARE SH extensions missing key_share NX_TLS13_RECV_SH_BAD_GROUP key_share group != X25519 (29) NX_TLS13_RECV_SH_BAD_KEYSHARE_LEN server keyshare != 32 bytes NX_TLS13_RECV_SH_INTERNAL HKDF/SHA-256/x25519 failed