nx_cert_autorenew_gate.nx

nx_cert_autorenew_gate.nx -- SOVEREIGN gate for the per-domain wildcard cert AUTO-RENEWAL logic. Proves the LOGIC the unattended renewer rests on, WITHOUT a heavy live LE issuance (that burns LE budget and needs the Porkbun vault + 4-min DNS propagation): the gate exercises only pure functions. (a) VERDICT: synthesize a validity field, parse notAfter via the REUSED x509_validity_get, and assert cm_verdict -> CM_WARN for a cert inside the 21d window, CM_OK far out, CM_EXPIRED past. This is the exact threshold core the live dual-epoch TLS probe (car_live_verdict) encodes. (b) MAPPING: the domain -> path mapping the driver pushes on is byte-correct -- le_<label>_* for the live SNI cert, /tmp/new_<domain>_* for the issue output -- for BOTH nishifamily.com and andelinwest.com. (c) TRIGGER: car_should_renew fires ONLY on WARN/EXPIRED (never on OK or NOCERT/unreachable). exit 0 = GREEN ; exit N = assertion N failed. license_tier: ORIGINAL