feat(ecosystem): compliant Praxis/Hexis integration + vendored build

Bring the Nexus/Praxis/Hexis integration in line with
MAVEN_ECOSYSTEM_ARCHITECTURE.md:

- Praxis over HTTP: drop the in-process praxis.db open (praxisstore/
  praxistools) and call praxisd's /api/v1/tools/* API via a new praxisClient.
  Honors the "no component reads another's DB" invariant (AC#12).
  PraxisConfig.DBPath -> URL.
- Hexis confirmation gate: mutating capabilities (ReadOnly=false) now park a
  bound pendingHexis confirmation and require a spoken "да" before executing;
  read-only run immediately (AC#7, no auto attention->action).
- Capability safety: >1 verb match is ambiguous -> ask instead of firing the
  first; ambiguous Nexus resolution asks for clarification (AC#2).
- Correlation IDs on Hexis execute, recorded in the cross-service trace.
- Bug: importance arrives as JSON float64 over HTTP, not int.
- Tests: confirm-gate, decline, read-only, and ambiguity paths.

Build: vendor/ bakes in the hexis client (replace-directed at a sibling repo
outside the Docker context); Dockerfile builds from vendor and no longer
`go mod download`s the unreachable replace paths.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vendor/modernc.org/sqlite/lib/sqlite_g_0000000000000043.go

@@ -0,0 +1,63 @@
+// Code generated by modernc.org/undup from the per-target sqlite_*.go files; DO NOT EDIT.
+
+//go:build (darwin && amd64) || (darwin && arm64) || (linux && 386)
+
+package sqlite3
+
+import (
+	"unsafe"
+
+	"modernc.org/libc"
+)
+
+// C documentation
+//
+//	/*
+//	** Return TRUE if pFile has been renamed or unlinked since it was first opened.
+//	*/
+func _fileHasMoved(tls *libc.TLS, pFile uintptr) (r int32) {
+	bp := tls.Alloc(144)
+	defer tls.Free(144)
+	var _ /* buf at bp+0 */ Tstat
+	return libc.BoolInt32((*TunixFile)(unsafe.Pointer(pFile)).FpInode != uintptr(0) && ((*(*func(*libc.TLS, uintptr, uintptr) int32)(unsafe.Pointer(&struct{ uintptr }{_aSyscall[int32(4)].FpCurrent})))(tls, (*TunixFile)(unsafe.Pointer(pFile)).FzPath, bp) != 0 || (**(**Tstat)(__ccgo_up(bp))).Fst_ino != (*TunixInodeInfo)(unsafe.Pointer((*TunixFile)(unsafe.Pointer(pFile)).FpInode)).FfileId.Fino))
+}
+
+// C documentation
+//
+//	/*
+//	** Memory map or remap the file opened by file-descriptor pFd (if the file
+//	** is already mapped, the existing mapping is replaced by the new). Or, if
+//	** there already exists a mapping for this file, and there are still
+//	** outstanding xFetch() references to it, this function is a no-op.
+//	**
+//	** If parameter nByte is non-negative, then it is the requested size of
+//	** the mapping to create. Otherwise, if nByte is less than zero, then the
+//	** requested size is the size of the file on disk. The actual size of the
+//	** created mapping is either the requested size or the value configured
+//	** using SQLITE_FCNTL_MMAP_LIMIT, whichever is smaller.
+//	**
+//	** SQLITE_OK is returned if no error occurs (even if the mapping is not
+//	** recreated as a result of outstanding references) or an SQLite error
+//	** code otherwise.
+//	*/
+func _unixMapfile(tls *libc.TLS, pFd uintptr, nMap Ti64) (r int32) {
+	bp := tls.Alloc(144)
+	defer tls.Free(144)
+	var _ /* statbuf at bp+0 */ Tstat
+	if (*TunixFile)(unsafe.Pointer(pFd)).FnFetchOut > 0 {
+		return SQLITE_OK
+	}
+	if nMap < 0 { /* Low-level file information */
+		if (*(*func(*libc.TLS, int32, uintptr) int32)(unsafe.Pointer(&struct{ uintptr }{_aSyscall[int32(5)].FpCurrent})))(tls, (*TunixFile)(unsafe.Pointer(pFd)).Fh, bp) != 0 {
+			return libc.Int32FromInt32(SQLITE_IOERR) | libc.Int32FromInt32(7)<<libc.Int32FromInt32(8)
+		}
+		nMap = (**(**Tstat)(__ccgo_up(bp))).Fst_size
+	}
+	if nMap > (*TunixFile)(unsafe.Pointer(pFd)).FmmapSizeMax {
+		nMap = (*TunixFile)(unsafe.Pointer(pFd)).FmmapSizeMax
+	}
+	if nMap != (*TunixFile)(unsafe.Pointer(pFd)).FmmapSize {
+		_unixRemapfile(tls, pFd, nMap)
+	}
+	return SQLITE_OK
+}