Defer DTLS handshake consumption until parse succeeds

[algesten]

Summary:

• Fixes Malformed handshake extensions poison the transcript: validate full message before consuming/transcript-append #142 by deferring DTLS handshake side effects until the assembled body parses successfully.
• Keep using the existing defragment buffer and track consumed fragments on the stack only.
• Add focused unit coverage that parse failures do not mark handshakes handled or update transcript state.

[algesten]

Alternative take on #143

@zRedShift I felt 143 was going in a very complex direction. I try again making it smaller.