feat(ecosystem): compliant Praxis/Hexis integration + vendored build

Bring the Nexus/Praxis/Hexis integration in line with
MAVEN_ECOSYSTEM_ARCHITECTURE.md:

- Praxis over HTTP: drop the in-process praxis.db open (praxisstore/
  praxistools) and call praxisd's /api/v1/tools/* API via a new praxisClient.
  Honors the "no component reads another's DB" invariant (AC#12).
  PraxisConfig.DBPath -> URL.
- Hexis confirmation gate: mutating capabilities (ReadOnly=false) now park a
  bound pendingHexis confirmation and require a spoken "да" before executing;
  read-only run immediately (AC#7, no auto attention->action).
- Capability safety: >1 verb match is ambiguous -> ask instead of firing the
  first; ambiguous Nexus resolution asks for clarification (AC#2).
- Correlation IDs on Hexis execute, recorded in the cross-service trace.
- Bug: importance arrives as JSON float64 over HTTP, not int.
- Tests: confirm-gate, decline, read-only, and ambiguity paths.

Build: vendor/ bakes in the hexis client (replace-directed at a sibling repo
outside the Docker context); Dockerfile builds from vendor and no longer
`go mod download`s the unreachable replace paths.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile

@@ -15,9 +15,10 @@
 # trixie, not bookworm: the prebuilt deps/lib/*.so are linked against
 # glibc 2.38 + GLIBCXX 3.4.32 (built on the Arch host). bookworm's glibc 2.36
 # is too old and the link fails on missing symbols. trixie ships glibc 2.40.
-# 1.24 (not 1.23) because golang trixie images start at 1.24; go 1.24 builds the
-# `go 1.23` module fine (the directive is a minimum).
-FROM golang:1.24-trixie AS build
+# 1.25 to match go.mod's `go 1.25.5` directive: the official golang images pin
+# GOTOOLCHAIN=local, so a 1.24 builder refuses the module instead of fetching a
+# newer toolchain. Bump this in lockstep with the go.mod directive.
+FROM golang:1.25-trixie AS build
 WORKDIR /src
 
 # libvulkan-dev: libggml-vulkan.so needs libvulkan.so.1 at link time.
@@ -30,7 +31,12 @@ COPY deps/piper/ /src/deps/piper/
 COPY deps/include/ /src/deps/include/
 COPY deps/whisper.cpp/ggml/include/ /src/deps/whisper.cpp/ggml/include/
 COPY go.mod go.sum ./
-RUN go mod download
+# vendored deps: the ecosystem clients (hexis) are replace-directed at sibling
+# repos outside the build context, so we can't `go mod download` them here.
+# `go mod vendor` (run on a host where the siblings exist) bakes them into
+# vendor/; with it present, go build uses it and never touches the replace
+# paths. Regenerate with `go mod vendor` whenever a sibling client API changes.
+COPY vendor/ ./vendor/
 COPY cmd/ ./cmd/
 # force rebuild 2026-07-10T16:50
 COPY internal/ ./internal/