62ceef89e9
Pin five negative-space properties of AliroGcm.decrypt that the NIST KAT suite doesn't exercise. Catches the implementation flaws most likely to slip into a userland AEAD impl: - decrypt_tamperedCiphertextByte: single bit flip in ct rejects + out[] unchanged (proves tag verify runs BEFORE GCTR-decrypt) - decrypt_tamperedTagByte: single bit flip in tag rejects + out[] unchanged (proves no early-exit / no conditional plaintext leak) - decrypt_wrongKey: single-bit key difference rejects (key confusion) - decrypt_wrongIv: single-bit IV difference rejects (replay-with-rebind) - decrypt_inputShorterThanTag: <16 B input throws ILLEGAL_VALUE without touching out[] (early bounds check) 13/13 AliroGcmTest tests pass (was 8 + 5 new). Full suite 152/0/0.