spec(port): port the psk external injection guard (Refs #8883)

[dmitrii-f-t27]

The twenty-second CR-CHAT-03 ring target (W3, tracker #8883, epic gHashTag/trios#1812): port of crates/trios-chat/rings/CR-CHAT-03/src/psk_external_injection.rs (Wave-26 Lane A, L-CHAT-3-psk, RFC 9420 5.3/12.4.4).

A smuggled Pre-Shared Key reference must never reach the key schedule. Rules, in the original's fixed order:

1. psk_nonce length == 32,
2. External: psk_id ∈ provisioned_external_ids,
3. Resumption: psk_group_id == local_group_id (cross-group splice rejected),
4. Resumption: psk_epoch < current_epoch (forward references are state-rollback primitives — equal and greater both rejected),
5. (psk_id, psk_group_id, psk_epoch, psk_nonce) ∉ used_nonces — keyed on the whole quad: the same nonce at a different epoch is fresh (PSK-10).

Carried as the D5 verdict — all five original error variants carry no payload, so the code is the whole verdict.

Adaptations (t27 conventions): reference/view structs → flat parameters, byte vectors as plain slices; the provisioned set → slice of records (identifier + length); the consumed-quad ledger → slice of records holding the identifier, the group identifier (possibly empty — the external form carries none), the epoch and the canonical nonce; both BTreeSet contains answered by scans; the empty group form lives as a local empty array in each test that carries it.

All 10 original PSK tests transcribed with exact asserts (both the equal-epoch and the past-epoch rollbacks; the replay quad with the empty external group), plus 3 helper tests and a rule-order ladder with the consumed quad riding under every earlier rule — 14 total.

Checks (conventions 0-14): t27b test 14 passed 0 failed, 0 blockers; t27c test-report 14/14, 0 vacuous; gen-rust output compiles under rustc (0 'static str, 0 Vec<const); coverage Untested 0; ASCII only; seal saved, all hashes MATCH; ledger row added to docs/reports/t27b_expectations.json.

Refs #8883

[dmitrii-f-t27]

All required checks green (validate, check-linked-issue, parse-ratchet, t27b-native-linux, t27b-native-macos); cli-tri / duplicate-bodies / t27b-native-ratchet are the known non-required reds. Steward READY. Twenty-second CR-CHAT-03 target (22/47 T-PORT) — requesting owner merge when convenient, Refs #8883.

[dmitrii-f-t27]

Superseded by #10175: the remaining CR-CHAT targets now land as one port-wave batch per specs/policy/pr_budget.t27 (#10067/#10074), which asks for one PR per ring batch instead of one per file. The spec body, seal and ledger row in this PR are unchanged there; the batch also carries one self-consistent duplicate-body bless. Closing this one-file PR keeps the merge queue and the Actions queue small.