Initial commit: Hexis capability registry + execution service baseline

Go daemon (hexisd/hexisctl) implementing capability registry, guarded
execution (confirmations, blessed-entity checks), systemd/workspace-mcp
providers per ECOSYSTEM-SPEC.md. Snapshotting existing working state
before further development.

internal/domain/errors.go

@@ -0,0 +1,18 @@
+package domain
+
+import "errors"
+
+var (
+	ErrCapabilityNotFound = errors.New("capability not found")
+	ErrExecutionNotFound  = errors.New("execution not found")
+	ErrConflict           = errors.New("version conflict")
+	ErrAmbiguousTarget    = errors.New("ambiguous target")
+	ErrTargetNotFound     = errors.New("target not found")
+	ErrTargetTypeMismatch = errors.New("target type does not match capability")
+	ErrCapabilityNotBound = errors.New("capability not registered for this entity")
+	ErrEntityRetired      = errors.New("entity is retired")
+	ErrEntityMerged       = errors.New("entity is merged")
+	ErrValidation         = errors.New("validation error")
+	ErrInternal           = errors.New("internal error")
+	ErrIdempotencyReplay  = errors.New("idempotent request already processed")
+)