nx_tools_canary_gate.nx

nx_tools_canary_gate.nx -- CANARY for the tools daemon (debt seq1373). license_tier: ORIGINAL WHY THIS EXISTS: nx_tools_api_serve.elf serves EVERY sovereign MCP tool, so it is the ONE service with no sovereign recovery path -- if a promoted binary crash-loops, the session loses nx_mgmt and therefore cannot call /api/rollback, because the rollback path runs THROUGH the thing being replaced. Promoting it on the strength of a compile is restart-and-hope. This gate makes the proof mechanical instead (rule 26). IT RUNS, IT DOES NOT MERELY COMPILE: it starts the STAGED binary on a throwaway port and then drives that SAME binary's own plain-HTTP probe client against it over a real socket. A successful bind is NOT evidence; a real GET /api/tools round-trip that returns the registry body is. T1 is the NON-VACUITY tooth: the identical probe against a port where nothing listens MUST fail. Without it a probe that silently returns 0 would report GREEN for a dead binary -- proving your 0 is the whole point.