nx_acquire_license_lib.nx

nx_acquire_license_lib.nx -- the LICENCE-URL DERIVATION as a LIBRARY. WHY A LIB, and it is the same unblock nx_licgate_lib records: an organ with main() CANNOT be imported (double-main), so a gate over a CLI can only fork the deployed binary. That fork is a boundary the mutation harness is blind across -- every mutant comes back NOT-REACHED and the gate returns a clean GREEN that reads exactly like a proof while proving nothing. Splitting the pure core out is what makes the logic mutation-testable at all. FAIL-CLOSED ON AN UNKNOWN HOST. Guessing a licence location for a host whose layout we have not established would fetch some other file and pin its digest as though it were a licence: a fabricated fact wearing a cryptographic pin, which is worse than no licence at all. Unknown -> -1. DERIVING A URL IS NOT EVIDENCE. This produces CANDIDATES. A row reaches evidence=READ only once those bytes are fetched, stored and pinned. license_tier: ORIGINAL