Initial commit: Hexis capability registry + execution service baseline

Go daemon (hexisd/hexisctl) implementing capability registry, guarded
execution (confirmations, blessed-entity checks), systemd/workspace-mcp
providers per ECOSYSTEM-SPEC.md. Snapshotting existing working state
before further development.

internal/domain/id.go

@@ -0,0 +1,25 @@
+package domain
+
+import (
+	"crypto/rand"
+	"encoding/base32"
+	"strings"
+)
+
+func NewCapabilityID() string {
+	b := make([]byte, 10)
+	rand.Read(b)
+	return "cap_" + strings.ToLower(base32.StdEncoding.WithPadding(base32.NoPadding).EncodeToString(b))
+}
+
+func NewExecutionID() string {
+	b := make([]byte, 14)
+	rand.Read(b)
+	return "exec_" + strings.ToLower(base32.StdEncoding.WithPadding(base32.NoPadding).EncodeToString(b))
+}
+
+func NewEventID() string {
+	b := make([]byte, 10)
+	rand.Read(b)
+	return "hevt_" + strings.ToLower(base32.StdEncoding.WithPadding(base32.NoPadding).EncodeToString(b))
+}