nx_registry_bounds_gate.nx

nx_registry_bounds_gate.nx -- the regression tooth for the reg_index OUT-OF-BOUNDS WRITE root-fixed 2026-07-31 (debt 1785506176). WHAT WENT WRONG: reg_index copied ss_get's length into the caller's buffer and took NO capacity argument, so its signature could not express safety. MEASURED LIVE: the mvault mv:ids index reached ~10.7 MiB (160269 ids x 70B) against a 4 MiB buffer in nx_mvault do_stats -- the vault's own ruler segfaulted and printed NOTHING -- and against an 8 MiB buffer in the /vault browse page. WHY THIS GATE EXISTS: the old defect was invisible to every test that only checked the HAPPY path, because a copy that overruns still returns the right number. So the load-bearing test here is T3/T6: a cap one byte too small must REFUSE and must leave the byte just past the cap UNTOUCHED. That byte is exactly what the pre-fix code clobbered, so this gate is PROVEN ABLE TO FAIL rather than decorative -- revert nx_registry.nx and T3/T6 go red. license_tier: ORIGINAL