nx_cap_provision_gate.nx

nx_cap_provision_gate.nx -- proves the FAIL-CLOSED cap-secret check. NEGATIVE CONTROLS are load- bearing: an absent keyfile, a too-short keyfile, AND a keyfile that still contains the baked placeholder must ALL read provisioned=NO (0) -- the three ways a server could silently fall back to a forgeable secret. Only a present, long-enough, non-placeholder key reads YES (1). Fixtures written to /tmp (survives WSL cold-boot; identical bytes each run = deterministic). verdict GREEN iff 5/5. license_tier: ORIGINAL