nx_dr_route_gate.nx

nx_dr_route_gate.nx -- KAT + neg-control for the web-vs-private router (DR-7). Proves coverage, all four route outcomes, the uses_web/uses_private predicates, boundary inclusivity, and the CENTRAL neg-control encoding DRBench's dominant failure fix: a query whose private coverage is BELOW threshold is NEVER routed private-only -- it always involves the web (WEB_ONLY or ESCALATE_WEB), so the agent can never dead-end. DRY verdict lib.