nx_tls12_porkbun_e2e_gate.nx

nx_tls12_porkbun_e2e_gate.nx -- PHASE 3 (final) LIVE e2e gate for the sovereign TLS 1.3 -> 1.2 fallback transport. PROVES the exact capability the expired nishifamily.com wildcard cert renewal needs: drive the REAL Porkbun DNS API over sovereign TLS 1.2 to 1. CREATE a UNIQUE test TXT record _acme-challenge.nishifamily.com -> assert the Porkbun API returns status SUCCESS (over TLS 1.2), then 2. DELETE it -> assert SUCCESS. The delete ALWAYS runs (guaranteed cleanup -- the test record is fully reversible). The Porkbun calls go through nx_acme_req, which tries TLS 1.3 first, sees api.porkbun.com refuse 1.3 (version-negotiation alert), reconnects, and completes over the proven sovereign TLS 1.2 client. REGRESSION row 0: a TLS 1.3 host (the Let's Encrypt directory) must STILL work through the SAME transport -- a harmless read-only GET (no account, order, or challenge is created) that proves the 1.3 path is intact and the 1.3-vs-1.2 selection is correct. This gate NEVER triggers an ACME challenge; it stays entirely in the Porkbun / TLS layer. Creds come from the sovereign vault: run ./_offc/nx_secret_cli.elf get porkbun first (writes /tmp/nxsecret.out: line1=apikey, line2=secretapikey); this gate reads that file (never a flat-file secret store, never hardcoded). expect_exit: 0 license_tier: ORIGINAL