Adds the zero-copy AES-128-CTR capability contracts, strict X.509 certificate DER/SPKI extraction, and precise invalid-key-material failures required by the DTLS-SRTP stack.
Validated with the pinned Swift 6.4 snapshot on macOS: 180 tests passed, 0 failed, 0 skipped.