feat(ecosystem): compliant Praxis/Hexis integration + vendored build

Bring the Nexus/Praxis/Hexis integration in line with
MAVEN_ECOSYSTEM_ARCHITECTURE.md:

- Praxis over HTTP: drop the in-process praxis.db open (praxisstore/
  praxistools) and call praxisd's /api/v1/tools/* API via a new praxisClient.
  Honors the "no component reads another's DB" invariant (AC#12).
  PraxisConfig.DBPath -> URL.
- Hexis confirmation gate: mutating capabilities (ReadOnly=false) now park a
  bound pendingHexis confirmation and require a spoken "да" before executing;
  read-only run immediately (AC#7, no auto attention->action).
- Capability safety: >1 verb match is ambiguous -> ask instead of firing the
  first; ambiguous Nexus resolution asks for clarification (AC#2).
- Correlation IDs on Hexis execute, recorded in the cross-service trace.
- Bug: importance arrives as JSON float64 over HTTP, not int.
- Tests: confirm-gate, decline, read-only, and ambiguity paths.

Build: vendor/ bakes in the hexis client (replace-directed at a sibling repo
outside the Docker context); Dockerfile builds from vendor and no longer
`go mod download`s the unreachable replace paths.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/config/config.go

@@ -127,6 +127,40 @@ type Config struct {
 	// schedule. Empty ⇒ no routines. See internal/routine for the class
 	// distinction from reminders (user-stated) and care rules (world-state).
 	Routines []RoutineConfig `json:"routines,omitempty"`
+
+	// Praxis — the ecosystem attention-state service. When configured, maven
+	// calls the Praxis HTTP tools API for attention listing and item lifecycle.
+	// Maven never touches Praxis's database directly (ecosystem invariant: no
+	// component reads another's store). nil ⇒ ecosystem integration disabled.
+	Praxis *PraxisConfig `json:"praxis,omitempty"`
+
+	// Nexus — the canonical identity service. When configured, maven resolves
+	// entity references (projects, services, devices, etc.) through Nexus
+	// before acting on them. nil ⇒ resolution disabled (maven uses raw text).
+	Nexus *NexusConfig `json:"nexus,omitempty"`
+
+	// Hexis — the capability execution service. When configured, maven
+	// discovers and executes capabilities through Hexis for ecosystem actions.
+	// nil ⇒ no capability-aware routing.
+	Hexis *HexisConfig `json:"hexis,omitempty"`
+}
+
+// PraxisConfig — maven's connection to the Praxis attention service.
+type PraxisConfig struct {
+	// URL — the Praxis HTTP API base URL (e.g. "http://localhost:9742").
+	URL string `json:"url,omitempty"`
+}
+
+// NexusConfig — connection to the Nexus identity service.
+type NexusConfig struct {
+	// URL — the Nexus HTTP API base URL (e.g. "http://localhost:9740").
+	URL string `json:"url,omitempty"`
+}
+
+// HexisConfig — connection to the Hexis capability execution service.
+type HexisConfig struct {
+	// URL — the Hexis HTTP API base URL (e.g. "http://localhost:9741").
+	URL string `json:"url,omitempty"`
 }
 
 // RoutineConfig — one scheduled routine. Cron is a standard 5-field expression