nx_os_fs.nx

nx_os_fs.nx -- OS FILESYSTEM-NAMESPACE SEAM (the write-safety half; sibling of nx_os_proc.nx). Answers ONE question for the IO layer: is this path in the OS's device/kernel/firmware namespace, where a file write could touch hardware or kernel state? Rule 26 (never-brick) demands the answer be BY CONSTRUCTION -- compiled in, not config-disableable -- so the deny lives here, in code, and callers cannot toggle it off with a conf line. LINUX BACKEND (current): the kernel exposes devices/firmware knobs as FILES under /dev, /sys, /proc (e.g. /sys/firmware/efi/efivars -- an errant write there can brick a board; /dev/sda -- raw disk). A path is write-forbidden iff it IS or is UNDER one of those roots. NISHIOS-NATIVE (target): NishiOS has no ambient device files -- device access is capability-routed through typed channels, so the ambient-namespace hazard class does not exist; the native backend returns forbid only for its reserved kernel-object namespace. This file is the SOURCE-SWAP seam (same contract, swapped backend), exactly like nx_os_proc.nx. license_tier: ORIGINAL