nx_janitor_sprawl_gate.nx

nx_janitor_sprawl_gate.nx -- proves the JANITOR sprawl/junk-cleanup organ (nx_janitor_sprawl): an orphaned-registry-.tsv detector + REVERSIBLE quarantiner, with the cardinal NO-FALSE-POSITIVE law. Builds a hermetic /tmp fixture (a scan tree + a registry of 6 .tsv files) and calls js_run directly, so the gate never touches the real registry. The fixture is designed to DISCRIMINATE: - 3 PROTECTED tsvs: one referenced by a real path const, one named as a substring of a referenced longer name (boundary-protected), one mentioned ONLY in a // comment (over-protect law). - 3 ORPHAN tsvs: two plain unreferenced, plus bcensus.tsv -- which is a SUBSTRING of the referenced fix_bcensus.tsv and MUST STILL be quarantined (the left word-boundary must reject that shielding). NEGATIVE CONTROLS (load-bearing): the referenced/comment/boundary-protected files MUST stay put -- a false positive (quarantining a used file) flips the gate RED; the boundary orphan MUST move -- an over-broad substring-protect flips it RED. Plus idempotency (a second run moves nothing new). GREEN iff all 11 checks hold. Reversible: the action is rename(2) into quarantine, never delete. Sovereign: imports nx_janitor_sprawl + nx_syscalls (nx_cc->nxasm, no gcc). license_tier: ORIGINAL