nx_ownership_gate.nx

nx_ownership_gate.nx -- GATE for LN4 ownership moves (own_check_move) and LN5 use-after-free (own_check_uaf). ONE gate for both rungs because there is ONE checker: a move and a release are the same event -- the name stops naming a live buffer -- and two gates over one state machine would be two rulers for one invariant. THE RUNGS' DONE-RULES: a use after `__move(p)` is a compile error naming the local; a use after `sys_munmap(p, n)` is a compile error naming the local; the existing corpus builds unchanged under the default mode. SUBJECT IS argv[1] AND THERE IS NO DEFAULT. A gate that forks a compiler it was not given measures whatever happens to be installed and prints a fully-formed verdict about it -- the sibling compiler gates default to the live builder, and that default is exactly how a stale binary earns a green. Refusing costs one argument and removes the whole failure class, so this gate exits 3 (UNKNOWN -- "I could not look", never an acquittal) rather than guess. THE BITE IS TWO REAL COMPILERS, not a synthesised mutant: GREEN on a challenger built from a tree carrying the rung, RED on _offc/nx_cc_sovereign.elf (the live builder, which has no --ownership). Data captures in /tmp/nxown/, RUNNABLES under _build/ -- the NAS mounts /tmp noexec, so a runnable staged there passes every compile tooth and fails every run tooth with no diagnostic at all. Usage: nx_ownership_gate <compiler_elf> (CWD = the tree root) license_tier: ORIGINAL No hw writes (Rule 26).