fix(build): de-duplicate Cargo.lock capnp (closes #272) + refresh guix.scm version (#273)

Two build-hygiene fixes; the first unblocks all build CI.

## `fix(build)` — Cargo.lock duplicate `capnp` (closes #272)
The `capnpc` 0.25→0.26 bump (#267) left **two byte-identical** `capnp
0.26.0` stanzas in `Cargo.lock`, which cargo rejects (`package capnp is
specified twice in the lockfile`, exit 101) — reding **every** build job
(MVP Smoke, Boot Gate, the whole `T1/*` live-prover matrix) on every PR
since. Collapsed the duplicate; `capnp 0.25.6` (required by `capnpc`)
and the single `0.26.0` remain. Deterministic dedup of identical stanzas
— the build CI here will confirm (the authoring sandbox has no registry
cache to run `cargo --locked` locally).

## `chore(guix)` — version refresh
`guix.scm` declared `(version "1.5.0")` while the workspace is `2.3.0`
(`Cargo.toml` / `STATE.a2ml`). Bumped to match.

## Nix — already clean (nothing to remove)
echidna has **no** `flake.nix` / `flake.lock` / `*.nix` — the 2026-05-18
estate ruling was already applied (`STATE.a2ml`: "flake.nix + flake.lock
git rm'd"). Remaining `nix` mentions are **intentional deprecation
history** (CLAUDE.md, STATE.a2ml, manifest comments), plus a harmless
`.gitattributes` `flake.lock` line and `echidna-playground` CODEOWNERS
entries for non-existent files — left as-is (template/sub-project
managed). Say the word to purge those dead lines too.

Draft until reviewed.

https://claude.ai/code/session_01UAqDQaMwpUqWHUSZekGZWv

---
_Generated by [Claude
Code](https://claude.ai/code/session_01UAqDQaMwpUqWHUSZekGZWv)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

Cargo.lock

@@ -20,7 +20,7 @@
 (define-public echidna
   (package
     (name "echidna")
-    (version "1.5.0")
+    (version "2.3.0")
     (source (local-file "." "echidna-checkout"
                         #:recursive? #t
                         #:select? (git-predicate ".")))

guix.scm

@@ -98,21 +98,21 @@ async fn main() {
         .route("/health", get(health_check))
         // Prover endpoints
         .route("/api/v1/provers", get(handlers::list_provers))
-        .route("/api/v1/provers/:kind", get(handlers::get_prover))
+        .route("/api/v1/provers/{kind}", get(handlers::get_prover))
         // Proof endpoints
         .route("/api/v1/proofs", post(handlers::submit_proof))
         .route("/api/v1/proofs", get(handlers::list_proofs))
-        .route("/api/v1/proofs/:id", get(handlers::get_proof))
-        .route("/api/v1/proofs/:id", delete(handlers::cancel_proof))
+        .route("/api/v1/proofs/{id}", get(handlers::get_proof))
+        .route("/api/v1/proofs/{id}", delete(handlers::cancel_proof))
         // Tactic endpoints
-        .route("/api/v1/proofs/:id/tactics", post(handlers::apply_tactic))
+        .route("/api/v1/proofs/{id}/tactics", post(handlers::apply_tactic))
         .route(
-            "/api/v1/proofs/:id/tactics/suggest",
+            "/api/v1/proofs/{id}/tactics/suggest",
             get(handlers::suggest_tactics),
         )
         // Cross-prover exchange endpoints (OpenTheory / Dedukti).
         // Export is session-scoped; import is stateless.
-        .route("/api/v1/proofs/:id/export", get(handlers::export_proof))
+        .route("/api/v1/proofs/{id}/export", get(handlers::export_proof))
         .route("/api/v1/exchange/import", post(handlers::import_proof))
         // Consultant-mode Q&A — free-form question + optional context →
         // LLM-shaped markdown answer via BoJ's cartridge router.

src/interfaces/rest/main.rs

@@ -180,9 +180,9 @@ pub async fn start_server(port: u16, host: String, enable_cors: bool) -> Result<
         .route("/api/suggest", post(suggest_handler))
         .route("/api/search", get(search_handler))
         .route("/api/session/create", post(create_session))
-        .route("/api/session/:id/state", get(get_session_state))
-        .route("/api/session/:id/apply", post(apply_tactic_handler))
-        .route("/api/session/:id/tree", get(get_proof_tree))
+        .route("/api/session/{id}/state", get(get_session_state))
+        .route("/api/session/{id}/apply", post(apply_tactic_handler))
+        .route("/api/session/{id}/tree", get(get_proof_tree))
         // Additional UI-specific endpoints
         .route("/api/agent/plan", post(agent_plan_handler))
         .route("/api/aspect-tags", get(get_aspect_tags))
@@ -229,8 +229,8 @@ pub async fn start_server(port: u16, host: String, enable_cors: bool) -> Result<
     println!("  POST /api/suggest             - Get tactic suggestions");
     println!("  GET  /api/search?q=<pattern>  - Search theorems");
     println!("  POST /api/session/create      - Create proof session");
-    println!("  GET  /api/session/:id/state   - Get session state");
-    println!("  POST /api/session/:id/apply   - Apply tactic to session");
+    println!("  GET  /api/session/{{id}}/state   - Get session state");
+    println!("  POST /api/session/{{id}}/apply   - Apply tactic to session");
     println!("  WS   /ws/interactive          - WebSocket live proof session");
     println!();
     println!("Press Ctrl+C to stop the server");