nx_x509_validate_test.nx

nx_x509_validate_test.nx -- self-signed Ed25519 cert validation KAT. We don't construct a full RFC 5280 DER cert here -- that requires a DER encoder (queued). Instead we synthesise the minimum structure x509_verify_signature_ed25519 needs: a contiguous byte buffer holding [tbs || pubkey || sig], and a manually-set X509Cert struct pointing at the right offsets. The signature is REAL: signed with ed25519_sign_full at test time using RFC 8032 §7.1 TEST 1 priv -> pub. This proves the full chain: ed25519_sign produces a sig, x509_verify accepts it when given the right pubkey, rejects it when: - any tbs byte flipped - any sig byte flipped - signer_pubkey is wrong expect_exit: 0 license_tier: ORIGINAL