nx_fw_signed_robust_gate.nx

nx_fw_signed_robust_gate.nx -- proves the fusion: signature-gated A/B + factory never-brick. T0 signed-clean-flash : a signed capsule flashes + commits to the inactive bank -> SR_OK + selectable + flipped F1 forged-active-fallback : a FORGED image planted in the ACTIVE bank is NOT selected; -> selectable via signed factory sr_select falls back to a signature-valid image (the headline) F2 double-fault-factory : both banks dead -> the signed immutable factory -> selectable N1 all-bad-teeth : both banks + the factory all forged/garbage -> NOT selectable (honest) N2 forged-source-rejected : sr_safe_flash refuses to even WRITE a forged source -> SR_REJECTED, banks intact GREEN only if all five hold. ed25519 signs are minimized (auth + forged signed ONCE, copied per scenario). Evidence -> knowledge/status/fw_signed_robust_gate.log. Sovereign: imports nx_fw_signed_robust (-> nx_fw_capsule -> nx_ed25519) + nx_framed_append + nx_syscalls. license_tier: ORIGINAL