Native TLS integration matrix

The driver includes the production TLS implementation and invokes its public native entry points in a real Sigil VM. It installs only the test CA in that process, keeping certificate and hostname verification enabled. This is necessary because the current library searches system CA files before the SSL_CERT_FILE override. It does not set SIGIL_TLS_INSECURE.

Compile tls-client.c against the same sigil-lib and sigil-crypto headers and archives as the build under test, with MBEDTLS_CONFIG_FILE defined as "sigil_mbedtls_config.h". For example, with a configured C compiler:

cc -O2 -DMBEDTLS_CONFIG_FILE='"sigil_mbedtls_config.h"' \
  -I"$SIGIL_LIB_DIR/include" -I"$SIGIL_LIB_DIR/src" \
  -I"$SIGIL_CRYPTO_DIR/vendor/mbedtls/include" \
  -I"$SIGIL_CRYPTO_DIR/vendor/mbedtls" \
  test/fixtures/tls-client.c "$SIGIL_LIB_ARCHIVE" "$SIGIL_CRYPTO_ARCHIVE" \
  -lm -lpthread -o /tmp/sigil-tls-client
node test/fixtures/tls-matrix.cjs /tmp/sigil-tls-client

Node and OpenSSL are fixture dependencies; OPENSSL may select an explicit OpenSSL executable. Each child has a 15-second watchdog. The matrix generates a private test certificate and checks both TLS 1.2 and TLS 1.3: forty verified connections with encrypted roundtrips, wrong-host and untrusted certificates, and a successful reconnect after certificate rejection. A failure exits nonzero. The ordinary Sigil suite separately covers handshake deadlines and socket ownership for both connect and upgrade.