nx_tls12_prf_gate.nx

nx_tls12_prf_gate.nx -- TLS 1.2 PRF (P_SHA256) KNOWN-ANSWER GATE, rung 1 of the TLS-1.2 client arc (debt seq861). WHY THIS EXISTS even though nx_tls12_prf_test.nx already passed: that test is SILENT (prints nothing, exit 0) and carries NO `verdict=` anchor, so (a) the ecosystem judge cannot read it, (b) an hourly beat cannot report it, and (c) a silent pass is the weakest possible evidence -- an organ that returned 0 without testing looks IDENTICAL. This gate emits the anchor AND carries its own non-vacuity control (T4), so it can prove that its comparator is capable of reporting a mismatch at all. VECTOR PROVENANCE (honest): secret/label/seed and the 100-byte expected output are the widely-circulated IETF TLS-WG P_SHA256 test vector (secret 9bbe...db35, label "test label", seed a16c...f9da). NOTE the older test file's header credits "RFC5246 section 5" -- RFC 5246 defines the PRF but publishes NO test vectors, so that citation is wrong; the vector is the TLS-WG mailing-list one. Recorded rather than repeated. D001: emits a `verdict=` anchor. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0