feat(ecosystem): compliant Praxis/Hexis integration + vendored build

Bring the Nexus/Praxis/Hexis integration in line with
MAVEN_ECOSYSTEM_ARCHITECTURE.md:

- Praxis over HTTP: drop the in-process praxis.db open (praxisstore/
  praxistools) and call praxisd's /api/v1/tools/* API via a new praxisClient.
  Honors the "no component reads another's DB" invariant (AC#12).
  PraxisConfig.DBPath -> URL.
- Hexis confirmation gate: mutating capabilities (ReadOnly=false) now park a
  bound pendingHexis confirmation and require a spoken "да" before executing;
  read-only run immediately (AC#7, no auto attention->action).
- Capability safety: >1 verb match is ambiguous -> ask instead of firing the
  first; ambiguous Nexus resolution asks for clarification (AC#2).
- Correlation IDs on Hexis execute, recorded in the cross-service trace.
- Bug: importance arrives as JSON float64 over HTTP, not int.
- Tests: confirm-gate, decline, read-only, and ambiguity paths.

Build: vendor/ bakes in the hexis client (replace-directed at a sibling repo
outside the Docker context); Dockerfile builds from vendor and no longer
`go mod download`s the unreachable replace paths.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cmd/mavend/main.go

@@ -57,10 +57,10 @@ import (
 	"github.com/kami/maven/internal/delivery/ntfysink"
 	"github.com/kami/maven/internal/delivery/telegramsink"
 	"github.com/kami/maven/internal/ipc"
-	"github.com/kami/maven/internal/loop"
 	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/store"
 	"github.com/kami/maven/internal/webauthn"
+	"github.com/kami/maven/internal/loop"
 )
 
 var errLocked = errors.New("mavend: daemon locked — complete passkey assertion first")
@@ -241,13 +241,14 @@ func run(args []string) error {
 	// ----- daemon components (only wired when unlocked) -----
 	// Pre-declare so the unlock path can wire them later.
 	var (
-		gatherer   *loop.Gatherer
-		rules      []loop.Rule
-		phr        phraser.Phraser
-		voiceW     *voiceWiring
-		dispatcher *delivery.Dispatcher
-		tl         *tickLoop
-		coreAPI    ipc.CoreAPI
+		gatherer    *loop.Gatherer
+		rules       []loop.Rule
+		phr         phraser.Phraser
+		voiceW      *voiceWiring
+		dispatcher  *delivery.Dispatcher
+		tl          *tickLoop
+		coreAPI     ipc.CoreAPI
+		eco         *ecosystemWiring
 	)
 
 	if !locked {
@@ -288,8 +289,11 @@ func run(args []string) error {
 			}
 		}
 
+		// ecosystem — nexus + hexis + praxis (all over HTTP; no direct DB access)
+		eco = wireEcosystem(cfg)
+
 		// voice
-		voiceW, err = wireVoice(cfg, ipc.NewStoreAPI(st), phr, st.VectorMemory(), st)
+		voiceW, err = wireVoice(cfg, ipc.NewStoreAPI(st), phr, st.VectorMemory(), st, eco)
 		if err != nil {
 			return fmt.Errorf("wire voice: %w", err)
 		}
@@ -444,7 +448,9 @@ func run(args []string) error {
 				}
 			}
 
-			voiceW, err = wireVoice(cfg, ipc.NewStoreAPI(st), phr, st.VectorMemory(), st)
+			eco = wireEcosystem(cfg)
+
+			voiceW, err = wireVoice(cfg, ipc.NewStoreAPI(st), phr, st.VectorMemory(), st, eco)
 			if err != nil {
 				return fmt.Errorf("wire voice: %w", err)
 			}