nx_tls13_server_session_emit_cv.nx

nx_tls13_server_session_emit_cv.nx -- stone 7.5 of TLS server arc. Emits the server CertificateVerify handshake message: ECDSA-P256 signature over a transcript-bound context, wrapped as an AEAD-encrypted record. Per RFC 8446 §4.4.3, the signed content is: [0x20 × 64] (octet 0x20 = space, 64 bytes) "TLS 1.3, server CertificateVerify" (33 bytes, the string) 0x00 (separator) transcript_hash (32 bytes, SHA-256) ----- 130 bytes total ----- Signature: ECDSA-P256-SHA256. The signing primitive nx_ecdsa_p256_sign hashes input itself. Wire encoding: HT_CERTIFICATE_VERIFY (0x0f) (1 byte) u24 body_len (3 bytes) u16 signature_scheme = 0x0403 (ecdsa_secp256r1_sha256) u16 sig_len (DER signature length) DER-encoded ECDSA(r, s) (~70-72 bytes) State machine: requires CERT_SENT (i.e. EE has been emitted; the Certificate stone 6.5 is logically before this but is queued, so in v1 the substrate skips cert -- THIS IS HONESTLY ANONYMOUS-CERT STILL). Advances to CV_SENT. emit_sf (patched this commit) now accepts both CERT_SENT and CV_SENT. Honest scope statement: a real client interop'ing with a real public CA chain would expect Certificate to precede this message. This commit ships the SIGNATURE pipeline (key schedule + transcript + ECDSA + DER + AEAD record), composable with stone 6.5 when it ships. The signing primitive is KAT'd against RFC 6979 vectors. license_tier: ORIGINAL