feat(ecosystem): compliant Praxis/Hexis integration + vendored build

Bring the Nexus/Praxis/Hexis integration in line with
MAVEN_ECOSYSTEM_ARCHITECTURE.md:

- Praxis over HTTP: drop the in-process praxis.db open (praxisstore/
  praxistools) and call praxisd's /api/v1/tools/* API via a new praxisClient.
  Honors the "no component reads another's DB" invariant (AC#12).
  PraxisConfig.DBPath -> URL.
- Hexis confirmation gate: mutating capabilities (ReadOnly=false) now park a
  bound pendingHexis confirmation and require a spoken "да" before executing;
  read-only run immediately (AC#7, no auto attention->action).
- Capability safety: >1 verb match is ambiguous -> ask instead of firing the
  first; ambiguous Nexus resolution asks for clarification (AC#2).
- Correlation IDs on Hexis execute, recorded in the cross-service trace.
- Bug: importance arrives as JSON float64 over HTTP, not int.
- Tests: confirm-gate, decline, read-only, and ambiguity paths.

Build: vendor/ bakes in the hexis client (replace-directed at a sibling repo
outside the Docker context); Dockerfile builds from vendor and no longer
`go mod download`s the unreachable replace paths.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vendor/modernc.org/sqlite/dmesg.go

@@ -0,0 +1,56 @@
+// Copyright 2023 The Sqlite Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build sqlite.dmesg
+// +build sqlite.dmesg
+
+package sqlite // import "modernc.org/sqlite"
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+const dmesgs = true
+
+var (
+	pid  = fmt.Sprintf("[%v %v] ", os.Getpid(), filepath.Base(os.Args[0]))
+	logf *os.File
+)
+
+func init() {
+	t := time.Now()
+	// 01/02 03:04:05PM '06 -0700
+	dn := t.Format("sqlite-dmesg-2006-01-02-03-150405")
+	dn = filepath.Join(os.TempDir(), fmt.Sprintf("%s.%d", dn, os.Getpid()))
+	if err := os.Mkdir(dn, 0770); err != nil {
+		panic(err.Error())
+	}
+
+	fn := filepath.Join(dn, "dmesg.log")
+	var err error
+	if logf, err = os.OpenFile(fn, os.O_APPEND|os.O_CREATE|os.O_WRONLY|os.O_SYNC, 0644); err != nil {
+		panic(err.Error())
+	}
+
+	dmesg("%v", time.Now())
+	fmt.Fprintf(os.Stderr, "debug messages in %s\n", fn)
+}
+
+func dmesg(s string, args ...interface{}) {
+	if s == "" {
+		s = strings.Repeat("%v ", len(args))
+	}
+	s = fmt.Sprintf(pid+s, args...)
+	s += fmt.Sprintf(" (%v: %v:)", origin(3), origin(2))
+	switch {
+	case len(s) != 0 && s[len(s)-1] == '\n':
+		fmt.Fprint(logf, s)
+	default:
+		fmt.Fprintln(logf, s)
+	}
+}