f6_gate.nx

f6_gate.nx -- sovereign replacement for bench/f6_gate.sh. Reads the committed golden manifest, invokes nxc2 on each target, SHA-256 hashes the output, compares against the manifest hash. Any mismatch signals one of: (a) intentional change -- rerun with --update (b) non-determinism regression -- fix before shipping (c) toolchain compromise -- Thompson / Vault-7 attack signal Removes the last non-NishiLang language (bash) from the nishi-core build chain. The gate's logic is identical to the bash script's; only the driver changes. Usage: f6_gate -- check against committed manifest f6_gate --update -- overwrite the manifest Environment assumptions (same as f6_gate.sh): - nxc2 executable at ./../nxc2.exe relative to pwd - Manifest at ./f6_manifest.txt - Targets listed in manifest paths (relative to nxc2 dir) Invariants: FG1 Each target compiled under `--target asm --opt` with stdout captured via pipe+dup3. Same invocation as bash gate. Mismatch in options == mismatch against manifest expected. FG2 SHA-256 computed over captured bytes exactly; no trailing whitespace stripped, no normalization. Byte-identical semantics. FG3 Non-zero exit codes from nxc2 (compile errors) cause the target to be skipped (marked "# skip" in manifest) per the bash gate's behaviour. FG4 Output buffer caps: 16 MiB per target's asm. Larger is a configuration issue; we fail loudly rather than truncate.