Start .NET rewrite with wire and media crypto conformance

dotnet/README.md

@@ -0,0 +1,54 @@
+# VoiceCat .NET rewrite
+
+The first slice targets .NET 10: protobuf, control framing, voice headers, and media
+encryption. TLS, server/client state, audio, and UI migration are next. The existing
+C++ implementation remains the conformance oracle.
+
+From the repository root:
+
+```powershell
+dotnet restore dotnet/VoiceCat.slnx --locked-mode
+dotnet build dotnet/VoiceCat.slnx -c Release --no-restore
+dotnet test dotnet/VoiceCat.slnx -c Release --no-build
+```
+
+Dependencies are pinned in project files and lock files. Generated protobuf is build
+output; the schema remains `core/proto/voicecat.proto`. Production dependencies are
+Google.Protobuf (BSD-3-Clause), BouncyCastle.Cryptography (MIT), and the build-only
+Grpc.Tools (Apache-2.0). No GPL/LGPL dependencies are permitted.
+
+## C# conventions
+
+Use file-scoped namespaces, standard .NET naming, immutable values where useful, and
+spans for binary data. Invalid arguments throw; invalid network packets use parsing
+results or protocol exceptions. Async APIs accept cancellation tokens.
+
+Comments explain constraints that cannot be made clear in code. Avoid banners,
+implementation history, and narration. Keep durable design explanations in `docs/`.
+
+## Regenerating C++ fixtures
+
+The optional oracle target calls the existing C++ protobuf, header serializer, and
+libsodium media implementation. From the root, with the development dependencies:
+
+```powershell
+cmake --preset dev -DVOICECAT_BUILD_DOTNET_ORACLE=ON
+cmake --build --preset dev --target voicecat-dotnet-oracle
+New-Item -ItemType Directory -Force dotnet/tests/VoiceCat.Tests/Fixtures
+./build/dev/bin/voicecat-dotnet-oracle.exe dotnet/tests/VoiceCat.Tests/Fixtures/cpp-wire.json
+git diff -- dotnet/tests/VoiceCat.Tests/Fixtures/cpp-wire.json
+```
+
+On Linux/macOS, omit `.exe` and create the directory with `mkdir -p`.
+The oracle writes deterministic JSON directly, avoiding shell output encoding.
+Fixtures contain a framed ClientHello and media packets at counters 0, 1, 65535,
+and 65536. Keys contain bytes 0–31; payload bytes count upward from zero. The
+20-byte header has type 1, marker flag, codec 0, SSRC `0xcafebabe`, timestamp 960.
+Both managed crypto backends must match these bytes.
+
+## Next checkpoint
+
+Prove BouncyCastle TLS 1.3 loopback and interoperability with the C++ mbedTLS server,
+including exporter label `voicecat media v1`, one-byte direction contexts 0/1,
+and TLS leaf certificate fingerprint pinning. Then implement the managed server,
+tested first with the existing C++ CLI.