Migrate to IDF 5.5.3 candidate

Pin PlatformIO packages and toolchains, rebase protected SDK
overrides, and add WebSocket receive regression coverage. Document
isolated candidate validation, archive provenance, and remaining gates.

tests/web_httpd_idle/run.py

@@ -38,7 +38,7 @@ assert 'httpd_sess_delete(hd, sock_db);' in sess  # queued reusable-pointer clos
 assert ssl.index('httpd_sess_set_pending_override') < ssl.index('HTTPD_SSL_USER_CB_SESS_CREATE')
 adapter = (ROOT / 'src/web_httpd_adapter.c').read_text()
 idle = (ROOT / 'src/web_httpd_idle.c').read_text()
-assert 'ESP_IDF_VERSION_VAL(5, 5, 0)' in adapter
+assert 'ESP_IDF_VERSION_VAL(5, 5, 3)' in adapter
 for forbidden in ('httpd_sess_trigger_close', 'web_diagnostics', 'xTaskCreate', 'malloc(', 'calloc(', 'ESP_LOG'):
     assert forbidden not in idle, forbidden
 sweep = function(adapter, 'web_httpd_idle_sweep')