Initial commit: Hexis capability registry + execution service baseline

Go daemon (hexisd/hexisctl) implementing capability registry, guarded
execution (confirmations, blessed-entity checks), systemd/workspace-mcp
providers per ECOSYSTEM-SPEC.md. Snapshotting existing working state
before further development.

internal/provider/registry.go

@@ -0,0 +1,50 @@
+package provider
+
+import (
+	"fmt"
+	"sync"
+
+	"github.com/kami/hexis/internal/domain"
+)
+
+type Provider interface {
+	Name() string
+	Execute(capability *domain.Capability, req *domain.ExecuteRequest) (map[string]any, error)
+}
+
+type Registry struct {
+	mu        sync.RWMutex
+	providers map[string]Provider
+}
+
+func NewRegistry() *Registry {
+	return &Registry{
+		providers: make(map[string]Provider),
+	}
+}
+
+func (r *Registry) Register(p Provider) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.providers[p.Name()] = p
+}
+
+func (r *Registry) Get(name string) (Provider, error) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	p, ok := r.providers[name]
+	if !ok {
+		return nil, fmt.Errorf("provider %q not found", name)
+	}
+	return p, nil
+}
+
+func (r *Registry) List() []string {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	var names []string
+	for n := range r.providers {
+		names = append(names, n)
+	}
+	return names
+}