Add managed TLS interoperability and persisted credentials

PROGRESS.md

@@ -10,6 +10,19 @@ up instantly. Newest status at the top.
 
 ## ▶ Where we left off / next action
 
+- **Done (2026-09-15): TLS exporter interoperability and persisted credentials.** Foundation commit
+  `b76181d` pushed to `origin/dotnet/foundations`. Added a nonblocking managed TLS 1.3
+  session with certificate acceptance gate and directional media factories. Managed
+  loopback and C++ interoperability pass; exporter keys are captured inside BouncyCastle's
+  handshake callback before its exporter secrets are destroyed. The C++ TLS oracle
+  authenticates encrypted challenges in both directions against the existing mbedTLS
+  context. Added explicit persisted TOFU pins, compatible Ed25519 identity/PEM import,
+  new certificate identity SAN, and rejection of incomplete credential sets.
+  **Verified:** 42/42 managed tests with the native TLS oracle enabled; native dev build
+  and 29/29 CTest tests green; 16 permissive package licenses verified. Complete socket
+  orchestration and managed server/client state remain pending.
+  **Next:** Phase 3 codec/DSP wrappers and native packaging.
+
 - **Done (2026-09-15): Initial .NET wire/crypto port** on `dotnet/foundations`, from `cs-port`.
   Added `dotnet/` solution, schema code generation, pipe framing, immutable voice headers,
   directional media encryption/decryption, and xUnit conformance tests. Both platform