nx_https_get_live_demo_test.nx

nx_https_get_live_demo_test.nx -- LIVE-FIRE demo against a real public HTTPS endpoint. Calls nx_https_get("https://example.com/", ...) with an EMPTY trust store, and asserts the failure mode is exactly the expected one (HANDSHAKE_FAIL caused by no trust anchor matching the real public cert chain). This proves -- against a real public server, no mocks -- that the substrate's lower layers all work: - nx_https_url_for_fetch parses the URL - nx_https_url_connect does DNS via real Cloudflare 1.1.1.1 (commit dfebc8bc wired this) + TCP connect to the resolved IP on port 443 - nx_tls13_client_session_run drives the handshake far enough to receive the server's Certificate message - The chain pipeline rejects the chain because no CA anchor is in the (empty) trust store What's NOT proven by this test: - Successful trust-anchor lookup (needs a real CA bundle) - Successful CV signature verification on the real server's CertificateVerify (currently stubbed; would matter once gap I lands) - HTTP layer working (we never reach it; handshake fails) expect_exit: 0 license_tier: ORIGINAL