[gby04]

What changed

• Derive a fixed session context from the canonical ephemeral public key pair and handshake transcript after secure session establishment.
• Bind AEAD IV derivation to the session context in addition to key, mode, role, and packet sequence.
• Require non-null, full-length, non-zero session context when initializing secure sessions.
• Add regression tests for context mismatch rejection and parameter defense.

Verification

• powershell -ExecutionPolicy Bypass -File tools\check_format.ps1
• cmake --build build-gby -j 1
• ctest --test-dir build-gby --output-on-failure
• .\build-gby\test_all.exe