fix(gui): bind the 4 nexus-setup wizard IPC handlers; refresh stale pin note

Shell.eph's bindAllHandlers bound 25 IPC commands but not the four the
nexus-setup wizard actually invokes — steam_resolve_vanity, nexus_stage_files,
nexus_provision, nexus_verify (wizard steps 2, 5, 6, 7). Bridge.eph implements
all four (handleSteamResolveVanity / handleNexusStageFiles / handleNexusProvision
/ handleNexusVerify) and panel.html calls them via gossamerInvoke, but with no
binding the webview→engine path was dead: those steps could never reach the FFI.
Added the four bindings mirroring the existing pattern exactly, matching each
handler's verified signature (steam_resolve_vanity is payload-only; the three
nexus_* take caps). The referenced scripts (provision-server.sh, steam-stage.sh)
both exist.

Note: Ephapax is an estate toolchain not present in this environment, so this is
verified by inspection against the existing 25 bindings and the Bridge.eph
signatures, not by a local compile.

Also: NEUROSYM.a2ml still cited the standards reusable pin as 4ddc926 (PR #45).
Updated to the current per-workflow pins (governance/scorecard d7c2271,
secret-scanner 891b1ed, mirror d135b05) with the bump history, pointing at
CI-CD-GUIDE.adoc as authoritative.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TaWWedv6VQqeZaPvc94keN

Author: claude

.machine_readable/descriptiles/NEUROSYM.a2ml

@@ -16,7 +16,10 @@ report-format = "logtalk"
 # NOT honoured by `hypatia scan` — it only excludes the file itself from being
 # scanned. The working mechanism is the repo-root `.hypatia-ignore`, consulted
 # by Hypatia.ScannerSuppression (code_safety + secret-detection paths).
-# Standards reusable pins: 4ddc926 (PR #45).
+# Standards reusable pins (current): governance/scorecard = d7c2271, secret-scanner = 891b1ed,
+# mirror = d135b05. History: 4ddc926 (PR #45) -> d135b05 (#49) -> d7c2271 (#55);
+# secret-scanner repinned d135b05 -> 891b1ed (#64). See docs/maintainer/CI-CD-GUIDE.adoc
+# for the authoritative per-workflow values.
 suppression-file = ".hypatia-ignore"
 suppression-scope = "7 reviewed false positives: 2 test-fixture secrets (fuzz_config.zig, .envrc), 3 escaped-markup innerHTML sinks (src/gui/fli/*.js), 1 loopback HTTP URL (template-hunt.k9.ncl), 1 syscall bitCast (probe.zig); plus a self-exemption so the file's own docs are not re-flagged"
 

src/core/Shell.eph

@@ -190,6 +190,16 @@ fn bindAllHandlers(channel: I64, caps: &GsaCapSet) -> I64 =
   let! channel = __ffi("gossamer_channel_bind", channel, "groove_drift_alert",
     fn(payload: String) -> String { Bridge.handleGrooveDriftAlert(payload, caps) }) in
 
+  -- Nexus Setup panel handlers (Wizard steps 2, 5, 6, 7)
+  let! channel = __ffi("gossamer_channel_bind", channel, "steam_resolve_vanity",
+    fn(payload: String) -> String { Bridge.handleSteamResolveVanity(payload) }) in
+  let! channel = __ffi("gossamer_channel_bind", channel, "nexus_stage_files",
+    fn(payload: String) -> String { Bridge.handleNexusStageFiles(payload, caps) }) in
+  let! channel = __ffi("gossamer_channel_bind", channel, "nexus_provision",
+    fn(payload: String) -> String { Bridge.handleNexusProvision(payload, caps) }) in
+  let! channel = __ffi("gossamer_channel_bind", channel, "nexus_verify",
+    fn(payload: String) -> String { Bridge.handleNexusVerify(payload, caps) }) in
+
   channel
 
 -- =============================================================================