nx_deploy_listen_gate.nx

nx_deploy_listen_gate.nx -- THE REFEREE FOR THE DEPLOY LISTEN CHECK (debt 1786068492). WHAT IT PROVES, AND WHAT IT DELIBERATELY DOES NOT. The subject is md_probe_listen_edge_cfg: the edge-triggered listener verification /api/deploy runs after it promotes and kills. The defect it exists to catch is NOT "no check ran" -- a check ran for weeks -- it is that the check was LEVEL-TRIGGERED, so "something is listening" was true both before and after the swap and a connect issued in the SIGKILL teardown window greened on the OUTGOING process. This gate therefore does not merely ask "did it say green"; it asks WHICH LISTENER the green describes. HERMETIC BY CONSTRUCTION: every fixture is a throwaway socket this gate binds itself, on a port it PROVES free first, in a forked child it reaps. It never touches a serving daemon and writes NO scratch file at all -- so it is idempotent by construction rather than by a teardown that a crash would skip. license_tier: ORIGINAL No hw writes (Rule 26).