nx_u256.nx

nx_u256.nx -- 256-bit unsigned big-integer primitives. Phase 0b §I.3 of the Nishi TLS 1.3 stack -- foundation for the ECDSA-P256 arc (which is the biggest single remaining blocker for public-HTTPS-fetch per task #21). Web PKI cert chains for google.com + Cloudflare + every modern CDN sign with ECDSA over NIST P-256, and verifying those sigs requires: 1. 256-bit big-int arithmetic (THIS primitive) 2. P-256 prime-field math (queued: nx_p256_field.nx) 3. P-256 curve-point math (queued: nx_p256_point.nx) 4. P-256 scalar math mod n (queued: nx_p256_scalar.nx) 5. ECDSA verify orchestrator (queued: nx_ecdsa_p256.nx) This module ships ONLY the raw unsigned 256-bit arithmetic + byte-order helpers. No field reduction, no curve, no signature. Representation: U256 is an 8-element i64 array where each element holds a 32-bit limb in its low bits and zeros in its high bits. Little-endian limb order: limb[0] is the least- significant 32 bits, limb[7] is the most-significant 32 bits. Why 8 x 32-bit limbs (not 4 x 64-bit): - Avoids signed-vs-unsigned i64 comparison hell that 4-limb would require for carry detection on (i64+i64) overflow. - 32-bit add/sub fits in i64 without overflow, so carry can be extracted with a clean (sum >> 32) & 1 instead of an unsigned-compare workaround. - 32-bit mul also fits in i64 (32 + 32 = 64 < 63 bits), so the upcoming p256_field_mul can use standard schoolbook limb-by-limb multiplication without 128-bit intermediates. - Matches BoringSSL's u32-limb P-256 implementation, which is the modern reference for non-vector platforms. Byte-order: X.509 / TLS / DER carry integers BIG-ENDIAN. All load/store helpers convert between BE byte buffers and our little-endian limb layout. What this primitive does: - u256_zero / u256_one / u256_copy / u256_alloc - u256_load_be (32-byte BE -> 8-limb LE)