Apply Phase 9D security mitigations

- Add fail-closed wolfSSL small-math policy and vectors
- Backport DHCP, EMS, and X.509 allocation fixes
- Extend source override validation and operational documentation

CMakeLists.txt

@@ -8,9 +8,14 @@ add_compile_definitions(
     NO_WOLFSSL_ESP32_CRYPT_AES
     NO_WOLFSSL_ESP32_CRYPT_HASH
     WOLFSSL_ED25519_STREAMING_VERIFY
+    # CVE-2025-12888: upstream PR9275 small math policy for enabled algorithms.
+    # These affect public key layouts; library and consumers must agree.
+    CURVE25519_SMALL
+    ED25519_SMALL
 )
 
 include($ENV{IDF_PATH}/tools/cmake/project.cmake)
 set(PROJECT_VER "0.1.0")
 project(esp32_serial_swiss_army_knife)
 include(cmake/security_overrides.cmake)
+include(cmake/wolf_crypto_policy.cmake)