Add restricted wolfSSH ordering fix

Apply hash-pinned generated edits for CVE-2025-14942 while keeping
wolfSSH 1.4.20 managed sources unchanged. Add the ABI header overlay,
provenance records, and real state-machine interoperability contracts.

tests/wolfssh_parser_contract/run.py

@@ -20,9 +20,10 @@ original, generated = render_entry(entry, {'project': ROOT})
 names = ('GetUint32', 'GetSize', 'GetString', 'GetSkip', 'GetStringRef',
          'DoIgnore', 'DoServiceRequest', 'DoChannelWindowAdjust', 'DoUserAuthRequestEcc',
                   'DoUserAuthRequestEd25519')
-# Verify this slice cannot accidentally change ordering or existing password logic.
+# Parser edits must not change the independently applied ordering/password logic.
 from security_overrides import apply_edits, MODIFICATION_NOTICE, WOLFSSH_PARSER_EDITS
-baseline = MODIFICATION_NOTICE + apply_edits(original.read_text(), entry.edits[len(WOLFSSH_PARSER_EDITS):])
+baseline = MODIFICATION_NOTICE + apply_edits(original.read_text(), tuple(
+    edit for edit in entry.edits if edit not in WOLFSSH_PARSER_EDITS))
 for name in ('DoUserAuthRequestPassword', 'DoPacket', 'DoChannelFailure',
              'ParseRSAPubKey', 'ParseECCPubKey', 'DoUserAuthRequestPublicKey'):
     assert extract(generated.decode(), name) == extract(baseline, name), name
@@ -75,5 +76,5 @@ with tempfile.TemporaryDirectory(prefix='wolfssh-parser-') as directory:
         result = subprocess.run([str(binary)], capture_output=True, timeout=30)
         assert result.returncode != 0, f'Undetected mutation: {label}'
     print(f'PASS: {len(mutations)} parser guard-removal mutations rejected')
-print('PASS: exact original hash; generated parser; unchanged ordering/password/deferred functions')
+print('PASS: exact original hash; generated parser; parser-isolated ordering/password/deferred functions')
 print('NOTE: production build-tree registration/firmware not regenerated or validated')