Initial commit: Hexis capability registry + execution service baseline

Go daemon (hexisd/hexisctl) implementing capability registry, guarded
execution (confirmations, blessed-entity checks), systemd/workspace-mcp
providers per ECOSYSTEM-SPEC.md. Snapshotting existing working state
before further development.

internal/api/server.go

@@ -0,0 +1,72 @@
+package api
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+
+	"github.com/kami/hexis/internal/execution"
+	"github.com/kami/hexis/internal/storage"
+)
+
+type Server struct {
+	handler *Handler
+	httpSrv *http.Server
+	socket  string
+}
+
+func NewServer(store *storage.Store, engine *execution.Engine) *Server {
+	handler := NewHandler(store, engine)
+	return &Server{handler: handler}
+}
+
+func (s *Server) ListenUnix(socketPath string) error {
+	dir := filepath.Dir(socketPath)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return fmt.Errorf("create socket directory: %w", err)
+	}
+
+	os.Remove(socketPath)
+
+	listener, err := net.Listen("unix", socketPath)
+	if err != nil {
+		return fmt.Errorf("listen unix: %w", err)
+	}
+
+	if err := os.Chmod(socketPath, 0660); err != nil {
+		listener.Close()
+		return fmt.Errorf("chmod socket: %w", err)
+	}
+
+	s.socket = socketPath
+
+	mux := http.NewServeMux()
+	s.handler.Register(mux)
+
+	return http.Serve(listener, mux)
+}
+
+func (s *Server) ListenHTTP(addr string) error {
+	mux := http.NewServeMux()
+	s.handler.Register(mux)
+
+	s.httpSrv = &http.Server{
+		Addr:    addr,
+		Handler: mux,
+	}
+
+	return s.httpSrv.ListenAndServe()
+}
+
+func (s *Server) Shutdown(ctx context.Context) error {
+	if s.httpSrv != nil {
+		return s.httpSrv.Shutdown(ctx)
+	}
+	if s.socket != "" {
+		os.Remove(s.socket)
+	}
+	return nil
+}