nx_container_run_test.nx

nx_container_run_test.nx -- proof that nx_container (sovereign Docker replacement) actually RUNS a process: run /tmp/nx_exit42.sov.elf in UTS+IPC+mount namespaces (rootfs="/" => no chroot, sees real FS) and assert the container captured its exit code (42). Needs root for unshare. expect_exit: 0 (0 == container ran the process and got exit_code 42) license_tier: ORIGINAL (direct import "nx_syscalls.nx" REMOVED 2026-07-31, debt 1785528831: this file also imports nx_container.nx which imports nx_syscalls_x86_64.nx, so the direct import put TWO syscall layers in one TU -- every wrapper twice, picked by definition ORDER. The syscalls it needs arrive via nx_container.nx, and the raw x86 numbers 165/161/272 pass through the backend translator correctly. Verified by reading emitted asm, not exit codes.)