nx_build_bypass_gate.nx

nx_build_bypass_gate.nx -- R2 of BACKEND-BUILD GOVERNANCE: the NO-BYPASS LAW + audit (PM control-plane), the build-time twin of the publisher's nx_pub_bypass_gate. It disk-WALKS a directory of organs (getdents64, the nx_ws_index_lib idiom) and cross-checks each against the build-registry (br_registered from nx_build_registry_lib): any organ on disk NOT in the registry = a BYPASS (built without registering), unless it is on the ALLOWLIST (exempt infra, the registrar's own analog of allowlisting the publisher). HERMETIC GATE w/ NEGATIVE CONTROL (GREEN means the audit actually discriminates, and the allowlist works): T1 reg=[A,B], C unregistered, no allowlist -> flagged == 1 (only C, the bypass) T2 then register C too -> flagged == 0 (no bypass remains -> responds to state) T3 fresh reg=[A,B], C unregistered, allowlist=[C] -> flagged == 0 (C exempt -> allowlist works) Sovereign: imports nx_build_registry_lib (+ nx_syscalls). license_tier: ORIGINAL expect_exit: 0