Initial commit: Hexis capability registry + execution service baseline

Go daemon (hexisd/hexisctl) implementing capability registry, guarded
execution (confirmations, blessed-entity checks), systemd/workspace-mcp
providers per ECOSYSTEM-SPEC.md. Snapshotting existing working state
before further development.

internal/storage/interface.go

@@ -0,0 +1,21 @@
+package storage
+
+import "github.com/kami/hexis/internal/domain"
+
+type Interface interface {
+	Close() error
+	CreateCapability(c *domain.Capability) error
+	GetCapability(id string) (*domain.Capability, error)
+	UpdateCapability(c *domain.Capability) error
+	ListCapabilities(entityID string) ([]*domain.Capability, error)
+	DeleteCapability(id string) error
+
+	CreateExecution(e *domain.Execution) error
+	GetExecution(id string) (*domain.Execution, error)
+	UpdateExecution(e *domain.Execution) error
+	GetExecutionByIdempotencyKey(key string) (*domain.Execution, error)
+
+	AppendEvent(evt *domain.Event) error
+	EventsAfter(seq int64, limit int) ([]*domain.Event, error)
+	LatestSequence() (int64, error)
+}