packaging: vendor nexum:host wit into videre via wit-deps

[mfw78]

What

Replace the cross-group wit/nexum-host symlink in the videre group with a wit-deps vendor: videre/wit/deps.toml pins nexum-host to an exact nexum-runtime git tag, videre/wit/deps.lock records the content digests, and videre/wit/deps/nexum-host is checked in. videre-host and videre-sdk bindgen path lists now point at wit/deps/nexum-host.

Why

Stacks on feat/m5-wit-local-l1 (crate-local WIT for L1). Once nexum-runtime is a separate repo, videre can no longer walk a shared ../../wit tree to reach nexum:host - it must resolve that dependency from a pinned, checked-in source. This is the L2 half of the wit-deps migration.

Testing

• nix develop -c cargo fmt --all --check
• nix develop -c cargo check --workspace --all-features
• nix develop -c cargo clippy --workspace --all-targets --all-features -- -D warnings
• nix shell nixpkgs#cargo-nextest -c cargo nextest run --workspace --all-features --no-fail-fast
• cargo test --doc

AI Assistance

Implemented with Claude Code under review.

Part of #405 (L2 half)

[lgahdl]

Verified the vendoring itself is clean: the 9 vendored .wit files (chain, event-module, identity, local-store, logging, messaging, query-module, remote-store, types) are byte-for-byte identical to the real nexum/wit/nexum-host source at the base commit (same git tree hash), the old symlink is correctly deleted in the same commit, and videre-host/videre-sdk's bindgen path lists have zero remaining references to it.

One critical gap before this can actually work, though:

[lgahdl]

This pinned tag doesn't exist on the real nullislabs/nexum-runtime repo — verified two ways: gh api repos/nullislabs/nexum-runtime/tags returns an empty list, and fetching this exact archive URL resolves to a 404 after the redirect. Since nullislabs/nexum-runtime genuinely already exists as a separate repo (the carve has happened), wit-deps update/resolution against this pin will fail outright the moment anyone actually runs it — and scripts/check-dep-sync.sh only checks textual agreement across manifests, not live tag existence, so this placeholder currently sails through CI unnoticed. The sha256/sha512 digests in deps.lock can't be genuine either, since there's no real archive to have hashed. Fix: cut and push an actual nexum-host-v0.1.0 tag on nullislabs/nexum-runtime (or point at a real existing tag/commit), then regenerate deps.lock from that real source via the actual wit-deps tool rather than hand-written digests.