nx_torrent_authn_gate.nx

nx_torrent_authn_gate.nx -- referee for the R3 session->level resolver (real OPAQUE, synthetic realm). Stands up a LIGHT-argon test realm; registers operator/family/stranger. PROVISIONS the roles registry BY HANDLE via tau_cred_id (operator=3, family=1; stranger ABSENT) -- the derive-from-handle path. Then logs each in to mint REAL Ed25519 tokens and drives tau_level. The crucial property: the id derived from a HANDLE (provisioning) equals the id a LOGIN TOKEN resolves to (runtime) -- so a by-handle-provisioned row actually grants the level at runtime. PROVES deny-by-default end to end: operator token -> 3 family token -> 1 no token -> 0 garbage -> 0 VALID token w/ NO provisioned role (stranger) -> 0 (leak-check) operator via ngs COOKIE -> 3 GREEN iff every row matches. Prints verdict=GREEN to STDOUT *and* returns the exit code. Durable -> knowledge/status/torrent_authn_gate.log. license_tier: ORIGINAL