Migrate to IDF 5.5.3 candidate

Pin PlatformIO packages and toolchains, rebase protected SDK
overrides, and add WebSocket receive regression coverage. Document
isolated candidate validation, archive provenance, and remaining gates.

src/ssh_memory.c

@@ -14,7 +14,7 @@
 #error "SSH memory requires heap poisoning disabled"
 #endif
 
-#if ESP_IDF_VERSION != ESP_IDF_VERSION_VAL(5, 5, 0)
+#if ESP_IDF_VERSION != ESP_IDF_VERSION_VAL(5, 5, 3)
 #error "Reaudit SSH memory usable extent contract for this IDF"
 #endif
 
@@ -44,7 +44,7 @@ void *ssh_memory_realloc(void *pointer, size_t size)
         return NULL;
     }
 
-    /* Audited unpoisoned IDF 5.5.0 reports the owned usable extent, including
+    /* Audited unpoisoned IDF 5.5.3 reports the owned usable extent, including
      * rounding. Do not substitute an interior-pointer/block-containing query. */
     size_t capacity = heap_caps_get_allocated_size(pointer);
     if (size <= capacity) {