nx_authz_svc_daemon.nx

nx_authz_svc_daemon.nx -- the DEPLOYABLE sovereign authorization SERVICE (the single-writer authz plane). Binds 127.0.0.1:8029 (LOOPBACK ONLY -- internal service-to-service; the public boundary already authenticated the user, so a caller's grantor identity is trusted here per rule 12). Owns ONE tuple store `authzsvc_` in the cwd (nishihost/, elderwesto-writable -> single writer, no cross-daemon permission mismatch, no append race). Every surface CHECKs and WRITEs through this over HTTP -> a group defined anywhere grants access everywhere. Build with --build-only; supervised by a reconcile cron (elderwesto), same idiom as office/survey. license_tier: ORIGINAL