An ESCRT grommet cooperates with a diffusion barrier to maintain nuclear integrity