nx_netscope_dns_test.nx

nx_netscope_dns_test.nx -- 1:1 KAT for NX-NETSCOPE L0+L1 (nx_netscope_dns.nx). Per the charter's KAT spec + the cardinal "1:1 proof, no proxy". HARD assertions are deterministic (no network needed); the live 8.8.8.8 probe is INFORMATIONAL (printed, not asserted) so the gate stays deterministic where internet is absent. T1 wire encode/decode: build_query tx_id round-trips T2 dead-IP 192.0.2.1 -> NXNS_TIMEOUT, bounded wall (THE no-hang proof) T3 WOULD-POISON race detector fires on a synthetic OK_A vs NXDOMAIN T4 PUBLIC-vs-RFC1918 hairpin detector fires on a public-IP OK_A T5 no false positive: when all resolvers AGREE (both OK_A) -> no race (live) 8.8.8.8 / example.com probe -- printed, not asserted expect_exit: 0 license_tier: ORIGINAL