Migrate to IDF 5.5.3 candidate

Pin PlatformIO packages and toolchains, rebase protected SDK
overrides, and add WebSocket receive regression coverage. Document
isolated candidate validation, archive provenance, and remaining gates.

src/ssh_memory.c

@@ -14,7 +14,7 @@
 #error "SSH memory requires heap poisoning disabled"
 #endif
 
-#if ESP_IDF_VERSION != ESP_IDF_VERSION_VAL(5, 5, 0)
+#if ESP_IDF_VERSION != ESP_IDF_VERSION_VAL(5, 5, 3)
 #error "Reaudit SSH memory usable extent contract for this IDF"
 #endif
 
@@ -44,7 +44,7 @@ void *ssh_memory_realloc(void *pointer, size_t size)
         return NULL;
     }
 
-    /* Audited unpoisoned IDF 5.5.0 reports the owned usable extent, including
+    /* Audited unpoisoned IDF 5.5.3 reports the owned usable extent, including
      * rounding. Do not substitute an interior-pointer/block-containing query. */
     size_t capacity = heap_caps_get_allocated_size(pointer);
     if (size <= capacity) {

src/web_httpd_adapter.c

@@ -10,11 +10,11 @@
 #include "esp_httpd_priv.h"
 #include "secure_random.h"
 
-#if ESP_IDF_VERSION != ESP_IDF_VERSION_VAL(5, 5, 0)
+#if ESP_IDF_VERSION != ESP_IDF_VERSION_VAL(5, 5, 3)
 #error "Reaudit HTTPD headers, upgrade, idle cleanup and WS/TLS send contracts for this IDF"
 #endif
 
-/* IDF 5.5.0 httpd_sess_process increments lru_counter only AFTER successful
+/* IDF 5.5.3 httpd_sess_process increments lru_counter only AFTER successful
  * req_new + req_delete (handler, response, leftover-body purge and cleanup).
  * Work callbacks run between sessions, never inside synchronous parse/TLS/send.
  * This counter is an observation marker, NOT permission to enable LRU purge. */
@@ -81,7 +81,7 @@ esp_err_t web_httpd_ws_send_binary(httpd_handle_t server, int fd,
         sd->ws_close || sd->for_async_req || !sd->send_fn)
         return ESP_ERR_INVALID_STATE;
 
-    /* IDF 5.5.0 httpd_ws_send_frame_async emits header/payload separately.
+    /* IDF 5.5.3 httpd_ws_send_frame_async emits header/payload separately.
      * Keep the existing send override (HTTPS -> esp_tls_conn_write), not raw
      * socket IO. Owner-local scratch lives through the synchronous call only. */
     uint8_t wire[WEB_HTTPD_WS_BINARY_MAX_PAYLOAD + 4U];
@@ -219,7 +219,7 @@ esp_err_t web_httpd_register_optional(httpd_handle_t server, const httpd_uri_t *
             return ESP_ERR_INVALID_STATE;
     }
     if (slot < 0) return ESP_ERR_NO_MEM;
-    /* IDF 5.5.0 publishes its descriptor before strdup; strdup failure leaves a
+    /* IDF 5.5.3 publishes its descriptor before strdup; strdup failure leaves a
      * freed hd_calls entry. Optional registration must leave the table intact. */
     httpd_uri_t *copy = malloc(sizeof(*copy));
     if (!copy) return ESP_ERR_NO_MEM;