nx_x509_leaf_check_test.nx

nx_x509_leaf_check_test.nx -- orchestrator verdict-mapping KAT. We do NOT round-trip through x509_parse here (the parser has its own existing coverage via nx_x509_validate and the SAN+validity smokes). Instead we exercise the orchestrator's dispatch logic directly by manually constructing X509Cert struct contents + the byte buffers the sub-primitives walk, then calling x509_leaf_check via a structural fast-path. Specifically we test the cases that x509_leaf_check can encounter in production once chained behind x509_parse on a real DER cert: - all checks pass -> NX_X509_LEAF_OK - parse failure (DER too short / corrupt) -> PARSE_FAIL - notBefore in future -> NOT_YET_VALID - notAfter in past -> EXPIRED - SAN missing -> NO_SAN - SAN present, hostname not covered -> HOSTNAME_MISMATCH - bad SAN format -> BAD_FORMAT - bad SAN pattern -> BAD_PATTERN - sealed verdict gate Note: x509_leaf_check internally calls x509_parse, but for the OK / SAN-mismatch / etc. cases we need a real DER cert. We build a minimal-but-real one inline. expect_exit: 0 license_tier: ORIGINAL