feat(ecosystem): compliant Praxis/Hexis integration + vendored build

Bring the Nexus/Praxis/Hexis integration in line with
MAVEN_ECOSYSTEM_ARCHITECTURE.md:

- Praxis over HTTP: drop the in-process praxis.db open (praxisstore/
  praxistools) and call praxisd's /api/v1/tools/* API via a new praxisClient.
  Honors the "no component reads another's DB" invariant (AC#12).
  PraxisConfig.DBPath -> URL.
- Hexis confirmation gate: mutating capabilities (ReadOnly=false) now park a
  bound pendingHexis confirmation and require a spoken "да" before executing;
  read-only run immediately (AC#7, no auto attention->action).
- Capability safety: >1 verb match is ambiguous -> ask instead of firing the
  first; ambiguous Nexus resolution asks for clarification (AC#2).
- Correlation IDs on Hexis execute, recorded in the cross-service trace.
- Bug: importance arrives as JSON float64 over HTTP, not int.
- Tests: confirm-gate, decline, read-only, and ambiguity paths.

Build: vendor/ bakes in the hexis client (replace-directed at a sibling repo
outside the Docker context); Dockerfile builds from vendor and no longer
`go mod download`s the unreachable replace paths.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vendor/modernc.org/sqlite/result.go

@@ -0,0 +1,42 @@
+// Copyright 2025 The Sqlite Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package sqlite // import "modernc.org/sqlite"
+
+type result struct {
+	lastInsertID int64
+	rowsAffected int
+}
+
+func newResult(c *conn) (_ *result, err error) {
+	r := &result{}
+	if r.rowsAffected, err = c.changes(); err != nil {
+		return nil, err
+	}
+
+	if r.lastInsertID, err = c.lastInsertRowID(); err != nil {
+		return nil, err
+	}
+
+	return r, nil
+}
+
+// LastInsertId returns the database's auto-generated ID after, for example, an
+// INSERT into a table with primary key.
+func (r *result) LastInsertId() (int64, error) {
+	if r == nil {
+		return 0, nil
+	}
+
+	return r.lastInsertID, nil
+}
+
+// RowsAffected returns the number of rows affected by the query.
+func (r *result) RowsAffected() (int64, error) {
+	if r == nil {
+		return 0, nil
+	}
+
+	return int64(r.rowsAffected), nil
+}