[aidangarske]

• wolfSPDM_TCG_GetPubKey sent GET_PUBK without a prior GET_VERSION
• Nuvoton NPCT75x answers that with ERROR UnexpectedRequest (0x04)
• GetPubKey now runs GET_VERSION first when no version is negotiated
• A failed GET_VERSION is returned without sending GET_PUBK
• wolfSPDM_ConnectTCG already negotiated first, so its path is unchanged
• Added a test where the mock rejects GET_PUBK before GET_VERSION, and one where GET_VERSION fails and the retry succeeds

needs wolfSSL/wolfTPM#670

[Copilot]

🟢 Approval recommended

No active review issues are reported for the change to negotiate the SPDM version before public-key discovery.

No open issues 🎉

What changed in this PR

Ensures TCG public-key discovery negotiates the SPDM version before sending GET_PUBK, addressing Nuvoton NPCT75x rejection of requests sent before negotiation.

Changes:

• Adds version negotiation for fresh contexts and returns negotiation errors without sending GET_PUBK.
• Adds tests for request ordering, reuse of the negotiated version, and successful retry after negotiation failure.

File	Description
test/​unit_test.c	Updates the mock to enforce negotiation ordering and adds success and failure/retry tests.
src/​spdm_tcg.c	Negotiates the version before GET_PUBK when the context is in its initial state.

_{Review effort: Balanced}