nx_pub_tls_serve.nx

nx_pub_tls_serve.nx -- pub_tls: serve the publisher's liveroot over the ecosystem's PROVEN sovereign TLS-1.3 server. The publisher does NOT re-implement TLS. It composes the proven sovereign stack: nx_edge_serve_static_response (builds the HTTP/1.1 response and AEAD-encrypts it via nx_tls13_server_session_app_send under the server app-traffic key) sitting on the TLS-1.3 server arc whose full handshake is proven by nx_tls13_server_full_handshake_test. pub_tls_http_for_file is the publisher-owned bridge: liveroot file -> the served HTTP response (the plaintext the TLS layer then encrypts). pub_tls_serve_file is the over-session path. license_tier: ORIGINAL