build: slim shepherd to the L3 CoW bundle over the split runtime

[mfw78]

Closes #407

What

Slim shepherd to the L3 CoW bundle over the split runtime. Delete the nexum (L1) and videre (L2) groups, promote the shepherd group to the repo root, and pin the cross-repo dependencies by commit to the now-populated upstream repos: nexum-* at nullislabs/nexum-runtime rev 17005ba, videre-* at nullislabs/videre-nexum-module rev 112868f.

Drop the umbrella [patch] and the venue-agnostic and dep-sync CI gates (owned by the upstream repos now); keep the root extensions.toml, which registers the videre client capability the keepers need. Repoint the Dockerfile, engine configs and operator scripts off the old group paths, and de-link a cfg-gated CowAdapter rustdoc reference.

Why

Completes the three-repo split (M5). shepherd becomes a CLI that runs a nexum-runtime with the videre platform module plus the composable-cow / ethflow keepers on the CoW-protocol venue, depending strictly up (L3 -> L2 -> L1) on the two upstream repos rather than carrying their sources in-tree.

Testing

nix develop gate green standalone, resolving L1+L2 from git by rev: rustfmt, clippy (-D warnings), the shepherd guest wasms (twap-monitor, ethflow-watcher, stop-loss + the cow-venue adapter), the workspace test suite, rustdoc, and the cow-orderbook-only gate.

AI Assistance

Authored with Claude Code.

[lgahdl]

This is the actual carve execution, so I verified the part that matters most as hard as possible: cloned the repo, checked out this branch, and ran cargo metadata --format-version=1 --locked for real. It succeeded (exit 0), and the stderr shows it genuinely fetched both https://github.com/nullislabs/nexum-runtime and https://github.com/nullislabs/videre-nexum-module over the network and resolved the full graph. I also independently confirmed both pinned commits exist and are exactly what they claim to be: nexum-runtime@17005ba5... is literally that repo's own "bootstrap standalone nexum-runtime repo" carve commit, and videre-nexum-module@112868fb... is its counterpart — and that commit's own message confirms it pins back to the same nexum-runtime SHA this PR uses, so all three repos agree on the same L1 commit. This is a real fix for the tag-existence problem flagged across #482/#483/#484 — switching from git tags (which never got pushed) to direct commit SHAs (which just need to exist in history, and do) makes this actually resolvable, not just internally consistent on paper.

The wholesale deletion of nexum/ and videre/ is complete and correctly matches what now lives upstream (verified via git diff --stat: the ~39,800 deleted lines are exactly those two trees, no partial/orphaned deletion). CI's venue-agnostic and dep-sync gate removal is appropriate — both upstream repos' bootstrap commits confirm they carried their own equivalent gates over (nexum-runtime's message cites "venue-agnostic zero-leak" in its own green gate, videre-nexum-module's cites "zero-leak" too), so this isn't a dropped check, just a relocated one. Dockerfile/docker-compose/engine.*.toml all moved to root correctly (confirmed via --stat, prior shepherd/-prefixed versions are the ones deleted).

One minor, non-functional doc staleness: engine.e2e.toml's header comment still lists "price-alert" and "balance-tracker" under stale nexum/modules/examples/... paths as part of a claimed "5 production + example modules" E2E run — but the actual [[modules]] entries in that same file only configure twap-monitor, ethflow-watcher, stop-loss, and cow-venue (the 3 modules + adapter this repo actually owns now). Those two other modules live only in nexum-runtime's own repo and aren't buildable from here anymore, so the comment overstates what this config actually runs — worth trimming those two lines or updating the count from "5" to "3".