nx_provstmt_gate.nx

nx_provstmt_gate.nx -- teeth over nx_provstmt_lib. IN-PROCESS, fixtures IN MEMORY, no filesystem. THE TOOTH THAT MATTERS IS T13: three DISTINCT digests must land in ORDER (subject, then srcSha256, then closureSha256). A contains-only suite passes with the fields cross-wired -- artifact sha in the predicate and source sha in the subject would satisfy every membership test while attesting the wrong object, which is this rung's entire failure mode. Order plus distinctness is what makes the wiring falsifiable.