nx_tls13_server_session_emit_sh.nx

nx_tls13_server_session_emit_sh.nx -- server-side ServerHello emitter + session orchestrator step (CH_RECEIVED -> SH_SENT). Inverse of the existing tls13_server_hello_parse (which the CLIENT uses to consume what we emit here). Round-trip proof in the accompanying smoke: server emits SH, client's parser consumes it. What this file ships: - tls13_ext_emit_supported_versions_server (single u16, no list) - tls13_ext_emit_key_share_server_x25519 (single KeyShareEntry) - tls13_server_hello_emit (full body + handshake header) - nx_tls13_server_session_emit_sh (session step, transcript update) Per RFC 8446 §4.1.3, ServerHello body layout: ProtocolVersion legacy_version = 0x0303; Random server_random[32]; opaque legacy_session_id_echo<0..32>; CipherSuite cipher_suite; (2 bytes, single) uint8 legacy_compression_method; (always 0) Extension extensions<6..2^16-1>; Extensions emitted by this server: supported_versions(43) -- single u16 selected_version = 0x0304 key_share(51) -- single KeyShareEntry { group, ke_len, ke } Cipher suite chosen: TLS_CHACHA20_POLY1305_SHA256 (the only AEAD the substrate currently implements; matches the client side's substrate-honesty cipher list in tls13_client_hello_emit). State machine: requires session.state == CH_RECEIVED; advances to SH_SENT on success. license_tier: ORIGINAL