S28.11: FreeRtosLwip BDD — TLS (mbedTLS over LwipRawTcpStream) + lwip analyze lanes + promote lwip jobs to required

[DavidCozens]

Parent epic: #439 (E28: lwIP Raw API support)

Final FreeRtosLwip slice. Depends on #472 (and #473 if TCP is split out).

Scope

• TLS: @tls Gherkin feature green — mbedTLS over SolidSyslogLwipRawTcpStream on the lwIP QEMU target (reuse mbedtls_user_config.h; budget generous QEMU handshake deadlines — cf. the S08.07 slice-6 TLS-on-QEMU saga and the QEMU-timeout convention).
• Analyze lanes: analyze-tidy-freertos-lwip + analyze-iwyu-freertos-lwip over the new target glue (netif wrapper, main.c). NB: Platform/LwipRaw/ classes are already covered by analyze-tidy-freertos-plustcp (it compiles Tests/Lwip); these lanes add value only for the FreeRtosLwip target glue.
• Promote to required: flip all five *-lwip jobs (build-freertos-host-tdd-lwip, build-freertos-target-lwip, bdd-freertos-qemu-lwip, analyze-tidy-freertos-lwip, analyze-iwyu-freertos-lwip) advisory → required in branch protection; update the README badge and the CLAUDE.md branch-protection list.

Acceptance criteria

• TLS feature green on the QEMU lwIP target.
• analyze-tidy-freertos-lwip + analyze-iwyu-freertos-lwip green.
• All five *-lwip jobs required in branch protection.
• README badge + CLAUDE.md branch-protection list updated.