Add restricted wolfSSH ordering fix

Apply hash-pinned generated edits for CVE-2025-14942 while keeping
wolfSSH 1.4.20 managed sources unchanged. Add the ABI header overlay,
provenance records, and real state-machine interoperability contracts.

cmake/security_overrides.cmake

@@ -28,6 +28,11 @@ endif()
 include("${CMAKE_BINARY_DIR}/security_overrides/manifest.cmake")
 set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS
     "${_sak_security_script}" "${SAK_SECURITY_VERSION_HEADER}")
+if(SAK_SECURITY_HEADER_IDS)
+    get_filename_component(_sak_security_tools "${_sak_security_script}" DIRECTORY)
+    set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS
+        "${_sak_security_tools}/wolfssh_order/delta.json")
+endif()
 
 # Public extension point: the Python Entry registry supplies the mapping. This
 # function is backend-agnostic; a later pinned project/vendor source uses it too.
@@ -112,6 +117,30 @@ function(sak_security_replace_source component original generated nested_target)
     message(STATUS "Security override: ${component}: ${original} -> ${generated}")
 endfunction()
 
+# HandshakeInfo and WOLFSSH are ABI-sensitive. Force the same generated header
+# into the library AND every transitive consumer, even if a consumer adds a
+# vendor include directory ahead of the overlay. The original include guard
+# then prevents a second, stale definition. This also creates compiler deps.
+foreach(_sak_security_id IN LISTS SAK_SECURITY_HEADER_IDS)
+    if(NOT _sak_security_id STREQUAL "wolfssh_internal_header" OR
+       NOT SAK_SECURITY_${_sak_security_id}_COMPONENT STREQUAL "wolfssl__wolfssh")
+        message(FATAL_ERROR "Security override: unaudited header overlay")
+    endif()
+    idf_component_get_property(_sak_security_wolfssh wolfssl__wolfssh COMPONENT_LIB)
+    if(NOT TARGET "${_sak_security_wolfssh}")
+        message(FATAL_ERROR "Security override: missing wolfSSH overlay target")
+    endif()
+    target_include_directories("${_sak_security_wolfssh}" BEFORE PUBLIC
+        "${SAK_SECURITY_WOLFSSH_INCLUDE}")
+    # PlatformIO's ESP-IDF adapter sorts app flags and deduplicates component
+    # flags. Keep option+operand atomic, as with wolf_crypto_policy.h.
+    target_compile_options("${_sak_security_wolfssh}" PUBLIC
+        "-include${SAK_SECURITY_${_sak_security_id}_GENERATED}")
+    set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS
+        "${SAK_SECURITY_${_sak_security_id}_ORIGINAL}"
+        "${SAK_SECURITY_${_sak_security_id}_GENERATED}")
+endforeach()
+
 foreach(_sak_security_id IN LISTS SAK_SECURITY_OVERRIDE_IDS)
     sak_security_replace_source(
         "${SAK_SECURITY_${_sak_security_id}_COMPONENT}"