nx_promote_deny_gate.nx

nx_promote_deny_gate.nx -- the safety proof for narrowing md_promote_deny_hard from a raw SUBSTRING to a TOKEN-BOUNDARY match plus an oracle exemption (debt 1785511766, 2026-07-31). This guard is NON-OVERRIDABLE by design: no conf row may make a credential organ promotable, or the role registry becomes a privilege-escalation surface. So the burden of proof for touching it is one-directional -- EVERY REAL CREDENTIAL ORGAN MUST STILL DENY (T1-T8). The false positives it removes (T9-T12) are only worth anything if that holds. A change to a security guard that only tests the newly-allowed cases is how a hole ships. license_tier: ORIGINAL