nx_https_get_happy_test.nx

nx_https_get_happy_test.nx -- REAL fork+child happy-path KAT for the nx_https_get / nx_tls13_client_session_run state machine over TCP loopback. Closes the verdict-only gap explicitly named in the 2026-05-19 PM honest verification audit (NISHI_HTTPS_ARC_STATUS_2026_05_19.md): "nx_https_get (commit 72771424): only tests BAD_URL paths. The full handshake + GET round-trip against a real or loopback HTTPS server is NOT yet a KAT. The lower wire layer IS verified via the pre-existing nx_https_loopback_test (fork+child TCP loopback running both TLS endpoints in NishiLang), but that test bypasses the Tls13ClientSession state machine wrapper..." This file builds the loopback test that DOES exercise the session state machine wrapper. Architecture: Parent process (CLIENT): - socket+bind+listen on 127.0.0.1:19454 - accept(); pass accepted fd to nx_tls13_client_session_run - assert session_run returns POSITIVE pointer (= state reached CONNECTED, all 4 dispatched recv_hs verdicts OK, app keys derived) Child process (SERVER): - socket+connect to loopback port - read ClientHello as REAL TLS record (5-byte header) - emit ServerHello as REAL TLS record (5-byte header) - derive handshake keys - emit AEAD-encrypted EE + Cert + CV + SF records - read AEAD-encrypted CF record The CERT carried in the Certificate message is a REAL 197-byte minimal v1 Ed25519 cert with SAN entry "localhost" matching the SNI hostname used by the client. The cert's outer sig is a REAL Ed25519 signature over its own TBS bytes (now that SHA-512 K constants are fixed -- commit c9ffedfd -- Ed25519 sign produces canonical FIPS-compliant output).