nx_wiki_publish_guard_gate.nx

nx_wiki_publish_guard_gate.nx -- TEETH for the pre-publish guard (nx_wiki_publish_guard). Proves the fail-closed "liar-kill": a page is ALLOWED only when it is fresh-stamped AND every [[cite:<cid>]] resolves in the content-addressed archive AND every internal /wiki/<x>.html link is in the corpus AND the body is real content. Positive control (well-formed page -> ALLOW) + FOUR negative controls, each asserting the EXACT machine-readable reason code (not merely "rejected"): (i) well-formed page -> PG_ALLOW (ii) no freshness stamp -> PG_REJECT_NO_FRESHNESS (iii) a dangling [[cite:<cid>]] (cid absent) -> PG_REJECT_DANGLING_CITE (iv) href to a /wiki page NOT in the corpus -> PG_REJECT_DEAD_LINK (v) empty / placeholder body -> PG_REJECT_PLACEHOLDER The positive control PLANTS a real resolvable citation: it archives a source body into a fresh per-run seg_store (ss_begin -> war_archive_page -> ss_commit), gets back the REAL cid, and embeds [[cite:<that cid>]] in the page -- so the guard's archive resolution is exercised end-to-end, not mocked. Appends "PUBGUARD ... verdict=PASS" to knowledge/status/pubguard_gate.log on all-pass. Exit 0 iff all pass (no fake-green). license_tier: ORIGINAL