nx_ciq_submit.nx

nx_ciq_submit.nx -- routes the S-class-verified CIQ bundle THROUGH THE PUBLISHER (operator: "pass to the publisher who should opaque gate it behind the family level"). Calls pub_submit (the no-bypass LAW intake) for each artifact with a dest under the FAMILY-GATED route prefix /wiki/family/ (opaque gate = authz level>=2 on that prefix, the recon's building block) so the analysis parses out to the wiki engine behind family auth, NOT public. Policy "outward" => the publisher's governed loop HOLDS at stage until the operator approval token exists (the "publish" authorization checkpoint) -> no direct/unapproved push, by construction. Pre-req: run nx_ciq_publish (emits the bundle) + nx_ciq_sclass_gate GREEN first. license_tier: ORIGINAL expect_exit: 0