feat(ecosystem): compliant Praxis/Hexis integration + vendored build

Bring the Nexus/Praxis/Hexis integration in line with
MAVEN_ECOSYSTEM_ARCHITECTURE.md:

- Praxis over HTTP: drop the in-process praxis.db open (praxisstore/
  praxistools) and call praxisd's /api/v1/tools/* API via a new praxisClient.
  Honors the "no component reads another's DB" invariant (AC#12).
  PraxisConfig.DBPath -> URL.
- Hexis confirmation gate: mutating capabilities (ReadOnly=false) now park a
  bound pendingHexis confirmation and require a spoken "да" before executing;
  read-only run immediately (AC#7, no auto attention->action).
- Capability safety: >1 verb match is ambiguous -> ask instead of firing the
  first; ambiguous Nexus resolution asks for clarification (AC#2).
- Correlation IDs on Hexis execute, recorded in the cross-service trace.
- Bug: importance arrives as JSON float64 over HTTP, not int.
- Tests: confirm-gate, decline, read-only, and ambiguity paths.

Build: vendor/ bakes in the hexis client (replace-directed at a sibling repo
outside the Docker context); Dockerfile builds from vendor and no longer
`go mod download`s the unreachable replace paths.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vendor/modernc.org/mathutil/rat.go

@@ -0,0 +1,26 @@
+// Copyright (c) 2014 The mathutil Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package mathutil // import "modernc.org/mathutil"
+
+// QCmpUint32 compares a/b and c/d and returns:
+//
+//	-1 if a/b <  c/d
+//	 0 if a/b == c/d
+//	+1 if a/b >  c/d
+func QCmpUint32(a, b, c, d uint32) int {
+	switch x, y := uint64(a)*uint64(d), uint64(b)*uint64(c); {
+	case x < y:
+		return -1
+	case x == y:
+		return 0
+	default: // x > y
+		return 1
+	}
+}
+
+// QScaleUint32 returns a such that a/b >= c/d.
+func QScaleUint32(b, c, d uint32) (a uint64) {
+	return 1 + (uint64(b)*uint64(c))/uint64(d)
+}