Wire hexis.resolve_target to real Nexus, fix changes cursor, pass full execute fields over MCP

resolve_target previously returned a hardcoded "requires_nexus_resolution"
placeholder; it now calls Nexus's /api/v1/resolve via a new minimal
internal/nexusclient, configurable with -nexus (default localhost:8987).

/api/v1/changes ignored the since query param and always returned from
sequence 0 (`since = 0` regardless of what was parsed) — fixed to actually
parse and use it, so change-cursor polling works.

The MCP hexis.execute tool only forwarded capability_id/target_entity_id/
arguments/idempotency_key, silently dropping entity_version, requested_by,
origin, correlation_id, causation_id, resolution_evidence, and
confirmation_id even though the native HTTP API and domain.ExecuteRequest
already supported all of them — MCP callers now get full parity.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018ghELqYhZNLub2TXGMazqA

cmd/hexisd/main.go

@@ -12,6 +12,7 @@ import (
 	"github.com/kami/hexis/internal/api"
 	"github.com/kami/hexis/internal/execution"
 	"github.com/kami/hexis/internal/mcp"
+	"github.com/kami/hexis/internal/nexusclient"
 	"github.com/kami/hexis/internal/provider"
 	"github.com/kami/hexis/internal/storage"
 )
@@ -22,12 +23,14 @@ func main() {
 	var mcpMode bool
 	var workspaceURL string
 	var workspaceAllowlist string
+	var nexusURL string
 
 	flag.StringVar(&httpAddr, "http", "", "HTTP listen address (default localhost:9741)")
 	flag.StringVar(&dataDir, "data", "", "Data directory for SQLite database")
 	flag.BoolVar(&mcpMode, "mcp", false, "Run in MCP stdio mode")
 	flag.StringVar(&workspaceURL, "workspace-url", "", "Workspace MCP HTTP API URL (e.g. http://localhost:9930)")
 	flag.StringVar(&workspaceAllowlist, "workspace-allowlist", "", "Path to workspace tool allowlist YAML")
+	flag.StringVar(&nexusURL, "nexus", "", "Nexus base URL for hexis.resolve_target (default http://localhost:8987)")
 	flag.Parse()
 
 	if dataDir == "" {
@@ -42,6 +45,12 @@ func main() {
 	if workspaceURL == "" {
 		workspaceURL = os.Getenv("WORKSPACE_MCP_URL")
 	}
+	if nexusURL == "" {
+		nexusURL = os.Getenv("HEXIS_NEXUS_URL")
+	}
+	if nexusURL == "" {
+		nexusURL = "http://localhost:8987"
+	}
 
 	dbPath := filepath.Join(dataDir, "hexis.db")
 
@@ -88,7 +97,7 @@ func main() {
 
 	if mcpMode {
 		log.Printf("starting MCP stdio adapter")
-		adapter := mcp.New(store, engine)
+		adapter := mcp.New(store, engine, nexusclient.New(nexusURL))
 		if err := adapter.ServeStdio(); err != nil {
 			log.Fatalf("MCP error: %v", err)
 		}