spec(port): port the commit path secret AEAD keying mismatch guard (Refs #8883)

[dmitrii-f-t27]

The first CR-CHAT-03 ring target (W3, tracker #8883, epic gHashTag/trios#1812): port of crates/trios-chat/rings/CR-CHAT-03/src/commit_path_secret_aead_keying_mismatch.rs (Wave-36, L-CHAT-3-cpakm, R-CHAT-3, RFC 9420 7.7/8/12.4.3.2).

A Commit that ships an UPDATE-PATH seals the new path secret once per leaf in each updated node's resolution, bound to the recipient's init key, to a nonce and to an AAD pinning the group, the epoch, the sender's leaf and the node. A mis-keyed slot poisons the whole epoch; the receiver rejects on a single deny. Rules, in the original's fixed order:

1. canonical GroupID length (32),
2. epoch advances by exactly 1 (saturating edge spelled explicitly),
3. sender_leaf < tree_size,
4. local_resolution_index within update_path_slots,
5. ciphertext length canonical (48 — rejected pre-decap, before the crypto-bound rules),
6. recipient_init_key == local_init_key,
7. aad_context == canonical group_id ‖ epoch ‖ sender_leaf ‖ node_index encoding, and slot.node_index == local_node_index.

Carried as the D5 verdict — all seven original error variants carry no payload, so the code is the whole verdict.

Adaptations (t27 conventions): commit/view structs → flat parameters (slices as parameters); Vec<u8> fields → fixed capacities + lengths where a rule reads the length (ciphertext gains a 64-capacity for the short/long fixtures); the canonical AAD encoding is a positional matcher over a power-of-256 table (t27 has no variable shifts), with the AAD lanes widened to u64 — t27 forbids the narrowing cast back to u8, every lane carrying one byte's worth.

All 10 original CPAKM tests transcribed with exact asserts, plus helper tests (init_keys_equal, aad_context_matches) and a rule-order test stacking each earlier violation on a later one (13 total), including the pre-decap ciphertext-length order over the key/AAD rules.

Checks (conventions 0-14): t27b test 13 passed 0 failed, 0 blockers; t27c test-report 13/13, 0 vacuous; gen-rust output compiles under rustc (0 'static str, 0 Vec<const); coverage Untested 0; ASCII only; seal saved, all hashes MATCH; ledger row added to docs/reports/t27b_expectations.json.

Refs #8883

[dmitrii-f-t27]

All required checks green (validate, check-linked-issue, parse-ratchet, t27b-native-linux, t27b-native-macos); cli-tri / duplicate-bodies / t27b-native-ratchet are the known non-required reds. Steward READY. First CR-CHAT-03 target (1/47 T-PORT) — requesting owner merge when convenient, Refs #8883.

[dmitrii-f-t27]

Superseded by #10175: the remaining CR-CHAT targets now land as one port-wave batch per specs/policy/pr_budget.t27 (#10067/#10074), which asks for one PR per ring batch instead of one per file. The spec body, seal and ledger row in this PR are unchanged there; the batch also carries one self-consistent duplicate-body bless. Closing this one-file PR keeps the merge queue and the Actions queue small.