Wire the 4 dead nexus-setup wizard handlers + refresh stale governance pin (#67)

<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
## Summary

A post-merge deep check of `main` (after #63–#66) found `main` in
excellent shape — build + 167 tests green across six suites, ABI
contract with no drift, the new AffineScript FFI contract in sync
(38/38), version SSOT clean at 0.9.0, and the Ephapax parser gaps
closed. It surfaced **one genuine defect** plus one stale metadata note;
this PR fixes both.

The defect: the `nexus-setup` GUI wizard's IPC handlers were never
bound. `Shell.eph`'s `bindAllHandlers` wired 25 commands but not the
four the wizard actually invokes, so wizard steps 2/5/6/7 (Steam
operator lookup, stage files, provision, verify) had no webview→engine
path — the calls went nowhere.

## Changes

- **`src/core/Shell.eph`** — bind the four missing `nexus-setup` IPC
handlers: `steam_resolve_vanity`, `nexus_stage_files`,
`nexus_provision`, `nexus_verify`. Each mirrors the existing binding
pattern and matches its verified `Bridge.eph` signature
(`handleSteamResolveVanity` is payload-only; the three `nexus_*`
handlers take `caps`). `panel.html` calls all four via `gossamerInvoke`;
`Bridge.eph` implements all four (lines 523–626); the scripts they drive
(`scripts/provision-server.sh`, `scripts/steam-stage.sh`) both exist.
- **`.machine_readable/descriptiles/NEUROSYM.a2ml`** — the standards
reusable-pin note still cited `4ddc926` (PR #45). Updated to the current
per-workflow pins (governance/scorecard `d7c2271`, secret-scanner
`891b1ed`, mirror `d135b05`) with bump history, pointing at
`CI-CD-GUIDE.adoc` as authoritative.

## RSR Quality Checklist

### Required

- [x] Tests pass — full `main` re-verified: 167 Zig tests across six
suites + fuzz compiles (this PR does not touch Zig)
- [x] No banned language patterns
- [x] No banned functions (`believe_me`, `unsafeCoerce`, …)
- [x] SPDX license headers present on all modified files
- [x] No secrets/credentials included

### As Applicable

- [x] ABI/FFI validated — regen produced no drift; AffineScript FFI
contract in sync (38/38)
- [ ] Documentation — no user-facing doc change needed (the wizard is
already documented in the wiki)

## Testing

`Shell.eph` is Ephapax, an estate toolchain **not present in this
environment**, so the binding change is **verified by inspection**, not
a local compile: it mirrors the 25 existing bindings exactly and matches
the `Bridge.eph` handler signatures and the `panel.html` call sites (all
confirmed by grep). The rest of the deep check ran for real — build, six
test suites (94+41+10+3+5+14), `gen_result_codes`/`gen_abi_expected`
regen + `git diff` (no drift), `affine-ffi-contract-check.sh`, and
`check_version_drift.sh` all green.

## Screenshots

```
Shell.eph bindAllHandlers: +4 bindings (steam_resolve_vanity, nexus_stage_files,
                                        nexus_provision, nexus_verify)
main verification: build OK · 167 tests pass · ABI no-drift · affine 38/38 · SSOT 0.9.0
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01TaWWedv6VQqeZaPvc94keN

---
_Generated by [Claude
Code](https://claude.ai/code/session_01TaWWedv6VQqeZaPvc94keN)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/descriptiles/NEUROSYM.a2ml

@@ -16,7 +16,10 @@ report-format = "logtalk"
 # NOT honoured by `hypatia scan` — it only excludes the file itself from being
 # scanned. The working mechanism is the repo-root `.hypatia-ignore`, consulted
 # by Hypatia.ScannerSuppression (code_safety + secret-detection paths).
-# Standards reusable pins: 4ddc926 (PR #45).
+# Standards reusable pins (current): governance/scorecard = d7c2271, secret-scanner = 891b1ed,
+# mirror = d135b05. History: 4ddc926 (PR #45) -> d135b05 (#49) -> d7c2271 (#55);
+# secret-scanner repinned d135b05 -> 891b1ed (#64). See docs/maintainer/CI-CD-GUIDE.adoc
+# for the authoritative per-workflow values.
 suppression-file = ".hypatia-ignore"
 suppression-scope = "7 reviewed false positives: 2 test-fixture secrets (fuzz_config.zig, .envrc), 3 escaped-markup innerHTML sinks (src/gui/fli/*.js), 1 loopback HTTP URL (template-hunt.k9.ncl), 1 syscall bitCast (probe.zig); plus a self-exemption so the file's own docs are not re-flagged"
 

src/core/Shell.eph

@@ -190,6 +190,16 @@ fn bindAllHandlers(channel: I64, caps: &GsaCapSet) -> I64 =
   let! channel = __ffi("gossamer_channel_bind", channel, "groove_drift_alert",
     fn(payload: String) -> String { Bridge.handleGrooveDriftAlert(payload, caps) }) in
 
+  -- Nexus Setup panel handlers (Wizard steps 2, 5, 6, 7)
+  let! channel = __ffi("gossamer_channel_bind", channel, "steam_resolve_vanity",
+    fn(payload: String) -> String { Bridge.handleSteamResolveVanity(payload) }) in
+  let! channel = __ffi("gossamer_channel_bind", channel, "nexus_stage_files",
+    fn(payload: String) -> String { Bridge.handleNexusStageFiles(payload, caps) }) in
+  let! channel = __ffi("gossamer_channel_bind", channel, "nexus_provision",
+    fn(payload: String) -> String { Bridge.handleNexusProvision(payload, caps) }) in
+  let! channel = __ffi("gossamer_channel_bind", channel, "nexus_verify",
+    fn(payload: String) -> String { Bridge.handleNexusVerify(payload, caps) }) in
+
   channel
 
 -- =============================================================================