_h2_serve_loopback_gate.nx

_h2_serve_loopback_gate.nx -- TUTOR-BOOTSTRAP SCAFFOLD (Claude, authored under the B1 rung(3) ALPN-h2 SERVER workflow of the R4-H2 HTTP/2-transport ladder), NOT credited as team self-authoring. THE LIVE LOOPBACK SERVE GATE: a single fork-based organ that stands up OUR sovereign ALPN-h2 TLS 1.3 SERVER and drives OUR sovereign h2 CLIENT against it over a real loopback socket -- both halves OUR stack, no openssl/nghttp2. Modeled byte-for-byte on the GREEN fork pattern of nx_browse_text_test.nx:102- 126 (socket/bind/listen/fork; child spins then connects; parent accepts). PRE-FORK (shared address space, inherited by both sides): - generate an Ed25519 keypair + build a self-signed X.509 leaf with SAN=localhost (sovereign: nx_csprng_fill + ed25519_pub_from_priv + nx_x509_build_self_signed), validity window covering now. - parse the cert into an X509Cert and add it as the SOLE anchor of a 1-entry TrustStore (a self-signed leaf is its own root; the store is subject-DN-keyed so issuer DN == subject DN finds the anchor). NO permissive/insecure validation context is built (fake-green forbidden). CHILD (the h2 CLIENT): spin a short busy-loop, connect, then nx_tls13_client_session_run_h2 (advertises ALPN ["h2"] only, validates the cert against our 1-entry store) -> h2_tls_get GET "/" -> assert it recovered :status 200 + the exact body bytes OUR server sent. PARENT (the ALPN-h2 SERVER): accept, then nx_tls13_server_session_run_h2_ed25519 (SELECTS ALPN "h2" via emit_ee_alpn + signs CV with the Ed25519 priv) -> app_recv the client's h2 open -> h2_server_recv_request (assert :method GET, :path "/") -> app_send the h2 response (SETTINGS+ACK+HEADERS :status 200 + DATA END_STREAM via h2_server_send_response). Parent exit code IS the verdict. HONEST verdict discipline: GREEN ONLY if the parent observes a successful server handshake + a correctly-parsed GET / request AND the child observes :status 200 + the exact body end-to-end. Any handshake failure, cert-validate failure, or status mismatch -> a NAMED negative exit code, never a faked 200. This is the one organ whose GREEN depends on the NAMED cert-self-verify risk: if nx_cert_gen's self-signed Ed25519 cert does not cleanly self-verify under nx_https_cert_pipeline_verify_with_store with SAN=localhost, the live half fails HONESTLY here (the in-memory gate nx_h2_server.nx stays the GREEN floor). FOUNDED ON (composes, each imported EXACTLY ONCE, RC6 double-import avoided): - nx_h2_server.nx: h2_server_recv_request / h2_server_send_response (it