tool, mavend: Hexis owns the tier of a Hexis capability (V-523)

read_only was the whole decision on the Hexis act path, which flattened three
answers into two. A capability that wipes the thing it names got the same
single spoken "да" as one that restarts a service, and requires_confirmation —
which the Hexis contract calls server-derived and never settable by a caller —
was read by nobody. docs/ecosystem.md §17.3 says confirmation follows risk.

RiskOfCapability reads Hexis's risk, read_only and requires_confirmation and
returns one of the three tiers internal/tool already had. It takes plain values
rather than a Capability, so internal/tool keeps no dependency on the Hexis
client. RiskOf keeps deriving, because a shell row the owner ticked on /tools
has no upstream to ask.

Every disagreement between the three fields goes up, never down: safe and
mutating is a contradiction and takes the confirm, an unrecognised tier takes
the confirm, and requires_confirmation may only raise. Same default as an
unrecognised dispatch shape — argue your way down, never up.

The irreversible refusal was a Go literal in two places and is now one deck
entry, act_needs_authed_surface. It lost four words to the persona ceiling.

cmd/mavend/ecosystem_acts.go

@@ -12,6 +12,7 @@ import (
 	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/store"
+	"github.com/kami/maven/internal/tool"
 )
 
 // The three services, spelled the way she says them out loud. A service that is
@@ -625,7 +626,24 @@ func (h *reactiveHandler) handleHexisAct(ctx context.Context, dec router.Decisio
 
 	// Read-only capabilities run immediately; mutating ones are parked for an
 	// explicit spoken confirm bound to this capability + target.
-	if !matched.ReadOnly {
+	// The tier decides, and Hexis owns the tier (Vikunja #523). read_only alone
+	// used to decide it here, which flattened three answers into two: a
+	// capability that wipes the thing it names got the same single spoken "да"
+	// as one that restarts a service, and requires_confirmation — which the
+	// Hexis contract calls server-derived and not settable by a caller — was
+	// read by nobody. docs/ecosystem.md §17.3 says confirmation follows risk.
+	tier := tool.RiskOfCapability(matched.Risk, matched.ReadOnly, matched.RequiresConfirmation)
+	policy := tool.PolicyFor(tier)
+	if !policy.VoiceMayRun {
+		// Irreversible. A confirm turn would not help, for the same reason it
+		// does not help a local row: the STT heard it, the model routed it and
+		// a substring matched the capability, and a spoken "да" checks none of
+		// those. She names the gap and he runs it himself.
+		h.recordEcosystemTrace(ctx, "hexis", "confirmation", traceRefused, started,
+			map[string]any{"entity_id": entityID, "capability": matched.Name, "risk": string(tier)})
+		return phraser.A(phraser.ActNeedsAuthedSurface, nil)
+	}
+	if policy.Confirm {
 		h.mu.Lock()
 		h.pendingHexis = &pendingHexisExec{
 			capabilityID: matched.ID,