nx_model_get_gate.nx

nx_model_get_gate.nx -- GATE for the offline decision half of G9 mg_fetch (nx_model_get_lib). The network half (nx_https_fetch_range windows + streaming sha256 + wp_ verify) is composed from already-gated incumbents (nx_weights_pull_gate proves the fail-closed verify; the fetch stack carries its own gates); what THIS gate proves is every decision nx_model_get makes around them: hash admission, dest-name admission (path escape), Content-Range/Content-Length parsing, and conf parsing. In-process over the lib. Planted-bad + neg-controls per tooth. license_tier: ORIGINAL expect_exit: 0