Prefer X25519 for legacy WSS full handshakes

Prioritize X25519 while retaining enabled curve fallbacks and log the negotiated ECDHE group. Extend ABI checks, crypto benchmarks and backend group probes, and document the updated APP package.

tools/test_mbedtls_cert.py

@@ -9,6 +9,7 @@ root = Path(__file__).resolve().parents[1]
 parser = argparse.ArgumentParser()
 parser.add_argument('chain', nargs='?', default=str(root / 'artifacts/wss/retest-443'))
 parser.add_argument('--compare-nist', action='store_true')
+parser.add_argument('--compare-windows', action='store_true')
 args = parser.parse_args()
 output = root / 'artifacts/wss/tls-speed/host-cert'
 output.mkdir(parents=True, exist_ok=True)
@@ -25,9 +26,12 @@ command = ['cl', '/nologo', '/O2', '/Gy', '/TC', '/D_CRT_SECURE_NO_WARNINGS',
            str(root / 'tools/test_mbedtls_cert.c'),
            str(root / 'ql-application/threadx/interface/custom_app/talkingq_root_ca.c')]
 command += [str(root / ('ql-kernel/threadx/quec_mbedtls/' + name + '.c')) for name in sources]
-for variant in (['baseline', 'nist'] if args.compare_nist else ['nist']):
+variants = ['window4', 'window5', 'window6'] if args.compare_windows else (['baseline', 'nist'] if args.compare_nist else ['nist'])
+for variant in variants:
     exe = output / ('test_mbedtls_cert_' + variant + '.exe')
     flags = ['/DWSS_TEST_DISABLE_NIST_OPTIM'] if variant == 'baseline' else []
+    if variant.startswith('window'):
+        flags += ['/DWSS_TEST_ECP_WINDOW=' + variant[-1]]
     subprocess.run(command + flags + ['/Fe' + str(exe), '/link', '/OPT:REF'], cwd=output, check=True)
     print('Certificate test variant:', variant, flush=True)
     subprocess.run([str(exe), str(chain)], check=True)