nx_acme_directory_live.nx

nx_acme_directory_live.nx -- FIRST live ACME network step: GET the Let's Encrypt directory over the sovereign TLS 1.3 client and print the JSON. Unauthenticated + not rate-limited (it is the API entry point), so it is the safe bottom-up milestone: it proves TLS to LE (cert chains to ISRG Root X1, present in the Mozilla store) + HTTP parse + gives real directory JSON to build the URL extractor against. Reuses the proven live-HTTPS path (nx_https_get_live_real_ca_test): load trust store -> url_for_fetch -> url_connect -> session_run -> get_complete -> http_response_parse. Default target: STAGING is "acme-staging-v02.api.letsencrypt.org" but staging chains to the "(STAGING) Pretend Pear X1" root which is NOT in the Mozilla bundle -> validation would fail. PRODUCTION directory GET is harmless + Mozilla-trusted, so we hit production here just to read endpoint URLs; actual issuance picks the env later. license_tier: ORIGINAL (composes the shipped TLS client + HTTP parse)