nx_fetch_bounded.nx

nx_fetch_bounded.nx -- bounded + timed streaming fetch drain (RES-R7). ROOT CAUSE this organ fixes: The existing drains silently lose data and can hang forever. - nx_browse_text.nx:55 br_drain : fills to `cap`, returns `off`, gives the caller NO way to tell "exactly cap" from "truncated at cap" -- silent truncation. No read timeout -> a stalled peer blocks sys_read forever. - nx_fetch_unit.nx:172 : `if blen > cap { blen = cap }` -- a SILENT clamp: oversize bodies are quietly chopped, length lost. No per-fetch timeout. THE FIX (mirrors the h2 large-page streaming-consume contract, h2_stream_consume): count the wire length UNBOUNDED, copy only up to `cap`, and report BOTH an explicit status code AND the full counted length. Never silently clamp. Enforce a wall-clock deadline via sys_poll so a stalled read returns within the budget with a timeout code instead of hanging the conductor. SINGLE RESPONSIBILITY: bounded+timed streaming drain over ANY readable fd. Composes only nx_syscalls.nx primitives (sys_poll, sys_read, sys_now_us, sys_mmap) -- fully sovereign, no network/TLS/gcc. The existing br_drain / nx_fetch_staged are NOT modified (additive-only); callers migrate to fb_drain_bounded in a later rung. build/placement: harness resolves `nx_fetch_bounded` -> runtime/nx_fetch_bounded.nx (2nd fallback). expect_exit: 0 license_tier: ORIGINAL