nx_media_jsexec.nx

nx_media_jsexec.nx -- JS-EXECUTION media harvester. Runs a page's JavaScript on the sovereign engine and collects the media URLs its code CONSTRUCTS AT RUNTIME (via functions, template literals, string concatenation, class methods) and hands to fetch()/XHR. These are exactly the URLs a STATIC byte/urlfold scan MISSES -- e.g. `fetch(cdn(id)+'/master.m3u8')` where the path is computed, not a literal. SAFE BY CONSTRUCTION for "don't get blacklisted / don't hang on a hostile page": * Fetches PEND -- the engine records the URL and returns a pending promise; it makes NO network call. So running the page cannot hit a rate limit, cannot be fingerprinted by request pattern, cannot leak. * We read the pending URLs and STOP -- we do NOT service them (no fetch storm, no recursive crawl here). * ⚠ REMAINING SAFETY (documented, not yet wired): the interpreter has NO instruction/loop budget, so a hostile `while(true){}` in page JS would hang. LIVE-CRAWLER wiring is BLOCKED on a fuel budget in the eval loop (a coordinated shared-core change -- see coordination.tsv; do NOT wire live until it lands). This module + its gate run only WELL-BEHAVED input, so they are safe today.