Add restricted wolfSSH ordering fix

Apply hash-pinned generated edits for CVE-2025-14942 while keeping
wolfSSH 1.4.20 managed sources unchanged. Add the ABI header overlay,
provenance records, and real state-machine interoperability contracts.

tools/wolfssh_order/921.patch

@@ -0,0 +1,32 @@
+From e9d288ec603531a1d544e77fb1bbdf634cb2a57f Mon Sep 17 00:00:00 2001
+From: John Safranek <john@wolfssl.com>
+Date: Mon, 13 Apr 2026 15:05:48 -0700
+Subject: [PATCH] Server Does Not Set expectMsgId to MSGID_NEWKEYS
+
+In the server code, the server is not setting the expectedMsgId to
+MSGID_NEWKEYS before sending its new keys message. Update DoKexDhReply()
+to set expectMsgId to MSGID_NEWKEYS.
+
+Affected function: DoKeyDhReply.
+Issue: F-1275
+---
+ src/internal.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/internal.c b/src/internal.c
+index 970bece9b..511d77ef2 100644
+--- a/src/internal.c
++++ b/src/internal.c
+@@ -12914,8 +12914,11 @@ int SendKexDhReply(WOLFSSH* ssh)
+         ret = BundlePacket(ssh);
+     }
+ 
+-    if (ret == WS_SUCCESS)
++    if (ret == WS_SUCCESS) {
++        ssh->handshake->expectMsgId = MSGID_NEWKEYS;
++        WLOG_EXPECT_MSGID(ssh->handshake->expectMsgId);
+         ret = SendNewKeys(ssh);
++    }
+ 
+     if (ret == WS_SUCCESS && ssh->sendExtInfo) {
+         ret = SendExtInfo(ssh);