nx_url_safety_gate.nx

nx_url_safety_gate.nx -- REFEREE for nx_url_safety_lib (the ONE SSRF URL ruler, mediaingest R11). THIS GATE IS BUILT AROUND THE ESTATE'S OWN MEASURED FAILURE. Its law: "Four SSRF deny-tests went green while the guard was wholly broken -- a url-decoder missing its SPACE terminator swallowed the request line so EVERY url refused as control bytes. A GUARD THAT REFUSES EVERYTHING PASSES EVERY NEGATIVE TEST. EVERY DENY-GUARD SHIPS WITH A POSITIVE CONTROL and every refusal test asserts WHICH RULE FIRED." So this gate does exactly two things a boolean suite cannot: 1. POSITIVE CONTROLS -- ordinary public URLs that MUST be ALLOWED. A refuse-everything regression fails here and nowhere else. 2. Every refusal asserts the REASON CODE, not merely that it was refused. A guard that refused a public CDN as IPV6_LITERAL would be broken while still "passing" any test that only asked "was it refused". No network, no disk: every input is a literal. license_tier: ORIGINAL