nx_https_pipeline_e2e_test.nx

nx_https_pipeline_e2e_test.nx -- THE end-to-end happy-path KAT for the full bits-up HTTPS cert verification pipeline. Closes the verification loop: this single test exercises every substrate primitive shipped this session for the public-HTTPS arc, from raw TLS 1.3 Certificate message bytes to a verdict. Flow: 1. Build a TrustStore + add the root cert as an anchor 2. Build a TLS 1.3 Certificate message wrapping a real DER leaf cert (built inline via build_min_cert below) 3. Call nx_https_cert_pipeline_verify_with_store(...) 4. Verify the returned verdict is NX_HTTPS_PIPELINE_OK Test vector setup: - Leaf cert: minimal-but-real DER cert from leaf_check_test (commit 50d861a8) with validity [2023..2026] + SAN "example.com" + Ed25519 SPKI (not exercised here -- root doesn't try to verify leaf's sig; we set sig_alg to Ed25519 to match) - Root cert: synthetic root with subject DN "CN=Root" - For ECDSA-style verify we'd need a real CA-signed cert which requires either a private CA key (we don't have signing) or a real-world cert vector. The RFC 6979 vector lets us do "sig over 'sample'" but not "sig over a real cert's tbs". So this KAT covers the EARLY-EXIT flow: build a real DER leaf whose tbs is well-formed but whose outer sig is garbage Ed25519 bytes. Pipeline gets to: - parse Cert message OK - parse leaf DER OK - leaf_check OK (validity + SAN both pass) - chain_verify -> verify_under_issuer dispatches by leaf's sig_alg (Ed25519) -> calls x509_verify_signature_ed25519 -> the underlying ed25519 verify is known broken (task #23) -> returns SIG_FAIL Expected end verdict: NX_HTTPS_PIPELINE_CHAIN_SIG_FAIL This KAT proves the full pipeline ROUTES correctly end-to-end: every sub-primitive is reached, every dispatch is exercised,