nx_mgmt_snapshot_run_gate.nx

nx_mgmt_snapshot_run_gate.nx -- PURE isolation gate for the producer's INSTANCE-vs-fork-child rule (msr_is_instance). This is the refinement that makes the per-service `procs` count trustworthy on the NAS: a fork-per-connection server (sites.elf / the gateways) has ONE listener + N connection-handler children that all match the same cmdline; counting them raw would false-flag `dup`. The rule (setsid-independent): a matched proc is a CHILD iff its parent is another matched proc of the SAME service. Negative controls T2/T3 are the children (must be filtered); T4/T5 prove a GENUINE duplicate (both parented by the supervisor) is still counted twice. No IO. GREEN iff every rule holds. Sovereign: nx_mgmt_snapshot_run + nx_syscalls. license_tier: ORIGINAL