Initial commit: Hexis capability registry + execution service baseline

Go daemon (hexisd/hexisctl) implementing capability registry, guarded
execution (confirmations, blessed-entity checks), systemd/workspace-mcp
providers per ECOSYSTEM-SPEC.md. Snapshotting existing working state
before further development.

Dockerfile

@@ -0,0 +1,14 @@
+# syntax=docker/dockerfile:1
+# Pure-Go (modernc sqlite) ⇒ CGO_ENABLED=0 static build, distroless output.
+FROM golang:1.25-alpine AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/hexisd ./cmd/hexisd
+
+FROM gcr.io/distroless/static-debian12
+COPY --from=build /out/hexisd /hexisd
+# WORKSPACE_MCP_URL is read from env (see compose) to wire the workspace MCP
+# provider; -http 0.0.0.0 so nginx/Maven can reach the capability API.
+ENTRYPOINT ["/hexisd", "-data", "/data", "-http", "0.0.0.0:9741"]