nx_x509_verify_rsa_gate.nx

nx_x509_verify_rsa_gate.nx -- DIRECT gate for the x509 RSA-verify family (flagged by the HONESTY SYSTEM 2026-07-16: nx_x509_verify_rsa_pkcs1_sha256 + nx_x509_pubkey_extract_rsa, reach ~479, no DIRECT test edge). A crypto-verify gate CANNOT be fake-greened: it passes only if every DER offset, the issuer-key extraction, and the RSA signature are ALL correct (unlike marker judges). Composition over REAL persistent certs: parse real_leaf.der -> parse the intermediate out of real_fullchain.der -> extract issuer RSA (n,e) -> verify the leaf's TBS signature under the issuer key -> must be OK ; then corrupt one sig byte -> must FAIL. Wrapper-logic tests (verdict validator + sig_len!=256 rejection) hold regardless of the leaf's algorithm. Rich diagnostics: prints parse rc, tbs/sig lens, and the leaf sig-alg OID so a RED is INFORMATIVE, not opaque. license_tier: ORIGINAL expect_exit:0