nx_trust_store_load_from_certdata.nx

nx_trust_store_load_from_certdata.nx -- BOOT-TIME CA TRUST STORE LOADER from a Mozilla NSS `certdata.txt` file on disk. Step 6 of the nx_https_client wiring arc -- the convenience wrapper that turns 3 shipped substrate primitives + 1 syscall helper into ONE boot-time call. After this primitive lands, the only remaining gap to first-byte-of-real-public-HTTPS is the actual Mozilla bundle file drop. Composes: 1. sys_read_file -- slurp the whole certdata.txt 2. nx_nss_certdata_parse -- text -> wire-format bundle 3. trust_store_alloc -- allocate the TrustStore 4. nx_x509_trust_store_load -- wire bundle -> populated store Plus internal: caller-tunable intermediate-buffer cap (the parsed wire-format bundle is held in RAM between the parse step and the load step; the buffer is sized at call time). Public API: nx_trust_store_load_from_certdata( path: *u8, NUL-terminated path to certdata.txt max_anchors: i64, trust_store_alloc capacity hint (typical Mozilla bundle ~150 CAs) parse_buf_cap: i64 intermediate wire-bundle buffer cap (typical Mozilla bundle ~250KB DER) ) -> POSITIVE store pointer (cast to i64) | NEGATIVE -verdict nx_trust_store_load_from_certdata_verdict_is_valid(v) -> 0|1 Sealed verdict enum: NX_TS_LOAD_CD_OK store loaded + ready to use NX_TS_LOAD_CD_FILE_FAIL sys_read_file returned empty (file missing / permission / IO) NX_TS_LOAD_CD_PARSE_FAIL nx_nss_certdata_parse returned non-OK (malformed/truncated text) NX_TS_LOAD_CD_LOAD_FAIL nx_x509_trust_store_load returned non-OK (bad DER / store full) NX_TS_LOAD_CD_ZERO_CERTS parse succeeded but 0 certs