nx_tls13_aead1302_gate.nx

nx_tls13_aead1302_gate.nx -- proves the 0x1302 (AES-256-GCM-SHA384) AEAD dispatch is REAL. WHY: our TLS client ADVERTISED 0x1302 and returned BAD_CIPHER, so every server preferring it (nginx's default) was unreachable -- and the crawler then retired those hosts as if THEY were dead. This gate covers the record-layer half: dispatch by cipher_suite to nx_aes256_gcm. It is deliberately a ROUND-TRIP + NEGATIVE-CONTROL gate, not a hand-written golden: sealing then opening under the same key must return the plaintext, a tampered tag must REFUSE, and an unknown suite must still return BAD_CIPHER (-2). No invented vectors. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0