nx_job_launch_bound_gate.nx

nx_job_launch_bound_gate.nx -- proves the widened async-launch bound before it ships into the SHARED nx_job_run launcher. Two failure modes, opposite directions, both fatal, so both are teeth: TOO TIGHT -> the widening does nothing and generators still need shell (T1-T4). TOO LOOSE -> a daemon or a control-plane organ becomes async-launchable, which is the brick (T5-T13). T13 is the one that matters most: nx_mgmt itself must be refused. T14 is the back-compat tooth: every organ the OLD substring rule allowed must still be allowed, because widening a shared launcher that quietly drops an existing caller is a regression wearing a feature's clothes. license_tier: ORIGINAL No hw writes (Rule 26).