fix(wolfssl): declare autoupdate for the CI audit

Every GitHub-direct descriptor must declare extensions.autoupdate. wolfSSL
tags are suffixed (v5.9.4-stable), so the tag template is v${version}-stable
and the archive URL is built from ${tag}. Candidate CI is what detects a
release that changes the transcribed source list or CMake defaults.

Author: yizhinailong

.agents/docs/2026-10-20-add-wolfssl-plan.md

@@ -31,6 +31,16 @@
   Curve25519/Ed25519 and system CA-store loading are off in CMake's default
   configuration and stay off here.
 
+## Automatic updates
+
+`extensions.autoupdate` is declared with `tag = "v${version}-stable"` and
+`url = "https://github.com/wolfSSL/wolfssl/archive/refs/tags/${tag}.tar.gz"`.
+The suffix is upstream's actual release-tag shape. The recipe also pins
+upstream's default source list and an options.h snapshot, so a release can
+add or remove translation units or change CMake defaults; candidate CI is
+what detects that, and the bump PR then needs a manual recipe update (the
+"upgrades requiring recipe changes" case in `docs/automatic-updates.md`).
+
 ## Feature evaluation
 
 No source-gated `features` are offered. CMake's optional components would

pkgs/c/compat.wolfssl.lua

@@ -43,6 +43,18 @@ package = {
     repo        = "https://github.com/wolfSSL/wolfssl",
     type        = "package",
 
+    -- Upstream's release tags carry a suffix: v5.9.4-stable, not v5.9.4.
+    -- The updater substitutes ${version} into `tag` and then uses ${tag} in
+    -- the URL. Candidate CI is what catches a release that changes the
+    -- transcribed source list or CMake defaults; when that happens the
+    -- descriptor needs a manual recipe update before the bump PR can pass.
+    extensions = {
+        autoupdate = {
+            tag = "v${version}-stable",
+            url = "https://github.com/wolfSSL/wolfssl/archive/refs/tags/${tag}.tar.gz",
+        },
+    },
+
     xpm = {
         -- No CN mirror has been published to gitcode/mcpp-res yet, so this
         -- uses the repository's plain-string upstream fallback rather than