nx_grab_ext_emit_gate.nx

nx_grab_ext_emit_gate.nx -- REFEREE for nx_grab_ext_emit (/compare/mediaingest R10 ge_emit). IN-PROCESS AND NETWORK-FREE. It imports the emitter and calls its pure functions against a PLANTED conf image held in memory, so nothing is written to disk, no browser is involved, and the production knowledge/grab_ext.conf is never read or touched by this gate. THE LOAD-BEARING TOOTH IS THE MV2/MV3 STRUCTURAL SPLIT. The whole reason both twins are emitted from one conf is that they must differ in STRUCTURE and never in POLICY: MV2: background.scripts, browser_action, and <all_urls> INSIDE permissions MV3: background.service_worker, action, and <all_urls> moved OUT to host_permissions A wrong split is the defect that ships a Chrome extension the store rejects, or a Firefox one whose host access silently does nothing. Testing that both manifests merely "contain the name" would pass on a broken split, so the teeth below check the permissions array CONTENTS on each side, in both directions -- present where it belongs and ABSENT where it does not. license_tier: ORIGINAL