feat(ecosystem): compliant Praxis/Hexis integration + vendored build

Bring the Nexus/Praxis/Hexis integration in line with
MAVEN_ECOSYSTEM_ARCHITECTURE.md:

- Praxis over HTTP: drop the in-process praxis.db open (praxisstore/
  praxistools) and call praxisd's /api/v1/tools/* API via a new praxisClient.
  Honors the "no component reads another's DB" invariant (AC#12).
  PraxisConfig.DBPath -> URL.
- Hexis confirmation gate: mutating capabilities (ReadOnly=false) now park a
  bound pendingHexis confirmation and require a spoken "да" before executing;
  read-only run immediately (AC#7, no auto attention->action).
- Capability safety: >1 verb match is ambiguous -> ask instead of firing the
  first; ambiguous Nexus resolution asks for clarification (AC#2).
- Correlation IDs on Hexis execute, recorded in the cross-service trace.
- Bug: importance arrives as JSON float64 over HTTP, not int.
- Tests: confirm-gate, decline, read-only, and ambiguity paths.

Build: vendor/ bakes in the hexis client (replace-directed at a sibling repo
outside the Docker context); Dockerfile builds from vendor and no longer
`go mod download`s the unreachable replace paths.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vendor/modernc.org/sqlite/lib/sqlite_g_0000000000007fff.go

@@ -0,0 +1,51 @@
+// Code generated by modernc.org/undup from the per-target sqlite_*.go files; DO NOT EDIT.
+
+//go:build (darwin && amd64) || (darwin && arm64) || (freebsd && 386) || (freebsd && amd64) || (freebsd && arm) || (freebsd && arm64) || (linux && 386) || (linux && amd64) || (linux && arm) || (linux && arm64) || (linux && loong64) || (linux && ppc64le) || (linux && riscv64) || (linux && s390x) || (netbsd && amd64)
+
+package sqlite3
+
+import (
+	"modernc.org/libc"
+)
+
+const MS_INVALIDATE = 2
+
+type Tpthread_t = uintptr
+
+const __restrict = 0
+
+// C documentation
+//
+//	/*
+//	** Return the system page size.
+//	**
+//	** This function should not be called directly by other code in this file.
+//	** Instead, it should be called via macro osGetpagesize().
+//	*/
+func _unixGetpagesize(tls *libc.TLS) (r int32) {
+	return int32(libc.Xsysconf(tls, int32(_SC_PAGESIZE)))
+}
+
+/*
+** Constants used for locking
+ */
+
+type pthread_attr_t = Tpthread_attr_t
+
+type pthread_cond_t = Tpthread_cond_t
+
+type pthread_condattr_t = Tpthread_condattr_t
+
+type pthread_key_t = Tpthread_key_t
+
+type pthread_mutex_t = Tpthread_mutex_t
+
+type pthread_mutexattr_t = Tpthread_mutexattr_t
+
+type pthread_once_t = Tpthread_once_t
+
+type pthread_rwlock_t = Tpthread_rwlock_t
+
+type pthread_rwlockattr_t = Tpthread_rwlockattr_t
+
+type pthread_t = Tpthread_t