_h2_serve_curl_daemon.nx

_h2_serve_curl_daemon.nx -- TUTOR-BOOTSTRAP SCAFFOLD (Claude, authored under the B1 rung(4) external-curl ALPN-h2 INTEROP workflow of the R4-H2 HTTP/2- transport ladder, REFACTORED at rung(5)), NOT credited as team self-authoring (back-fill via the emitter-of-emitters once the daemon-from-spec organ exists). RUNG(5) REFACTOR: the per-connection driver (was hcd_run_server) has been LIFTED VERBATIM into the reusable organ runtime/nx_h2_serve.nx (h2_serve_connection) -- BL-012 compose-not-duplicate. This daemon now SHRINKS to: mint cert + write PEM + bind/listen ONCE, then a COUNTED accept loop of N=HCD_N (=3) that, per connection, regenerates fresh handshake entropy, runs the handshake-then-serve via the lifted h2_serve_connection, closes, and stops-on-RED. cert + bind + listen happen ONCE; only accept + serve repeat. THE STANDALONE ALPN-h2 SERVE DAEMON: stands up OUR sovereign ALPN-h2 TLS 1.3 SERVER on 127.0.0.1:9443 and serves an EXTERNAL, INDEPENDENT h2 client (curl --http2 with libnghttp2/OpenSSL). It is the SERVER HALF of _h2_serve_loopback_gate.nx with the fork+child-client removed and a real bind/accept loop added; curl is the LAST-MILE interop measuring stick (the sanctioned HTTP last-mile exception), NEVER a substrate -- OUR server side is 100% sovereign nx_cc->nxasm (no gcc/openssl/nghttp2 in our implementation). FLOW (main): - mint a self-signed Ed25519 X.509 leaf (SAN=localhost) -- the SAME sovereign cert path the loopback gate proved (hsl_make_cert), here _hcd_make_cert. - EXPORT that DER cert to a PEM file (/tmp/nx_h2_interop_cert.pem) so an external curl can trust it via --cacert. PEM = ASCII wrapper around the DER: "-----BEGIN CERTIFICATE-----\n" + b64_encode(der) wrapped at 64 cols + "-----END CERTIFICATE-----\n", written with sys_openat_wr/write. (There is NO PEM-ENCODER organ; nx_pem.nx only DECODES. We COMPOSE the canonical nx_base64.nx b64_encode primitive rather than reinvent it.) - server x25519 ephemeral + random. - socket / SO_REUSEADDR / bind 127.0.0.1:9443 / listen; print "BOUND 127.0.0.1:9443" so the orchestrator's readiness gate fires. - ACCEPT LOOP (N=HCD_N=3): per connection accept -> fresh handshake entropy -> h2_serve_connection (the LIFTED driver in nx_h2_serve.nx: handshake SELECT "h2" + Ed25519 CV -> send our SETTINGS -> read-loop accumulate frames + ACK + parse HEADERS -> respond :status 200 + body + GOAWAY -> shutdown(SHUT_WR)+drain) -> close -> repeat; exit 0 after N served, stop-on-RED on any non-zero driver code.