feat: vendor Curry, preloaded and callable across the one universal wheel

Vendors curry_core.py from Athena-Pro/Curry (with the str.format()/format_map()
sandbox-escape fix from https://github.com/Athena-Pro/Curry/pull/4 already
applied) into synapse/, since Curry itself isn't a pip-installable package -
it's meant to be pointed at via a config path, which only works from a source
checkout. Vendoring a single self-contained, stdlib-only file ships it inside
NexusOS's own wheel with no extra dependency to reconcile.

synapse/curry_store.py opens it into a module-level singleton (curry_db) at
import time, the same pattern as memory.store.store and
playbooks.store.playbook_store, and main.py imports it so it's genuinely
initialized at process startup - preloaded, not lazy-on-first-use. Backed by
its own CURRY_DB file (nexus_config.py), separate from memory.db.

NexusOS builds exactly one wheel (py3-none-any, no compiled extensions) -
there is no separate Windows/macOS/Linux artifact; platform differences are
handled by requirement overlays at install time, not by building different
wheels. Verified the same wheel actually carries this correctly: built it,
confirmed twine check passes, confirmed synapse/curry_core.py and
curry_store.py are present in the archive (bin/check.sh's packaging gate now
asserts this too), then installed that exact wheel into a throwaway venv and
round-tripped a declare_constant/get_constant_latest call against it with no
source checkout present - proving "preloaded and ready to be called" holds
from the shipped artifact, not just editable-install execution.

Android/Termux is unaffected by this change in either direction: it already
has a separate, documented, pre-existing blocker in docs/TERMUX.md (no
published Android pydantic-core wheel) that has nothing to do with Curry,
which is pure stdlib and adds no new native/binary dependency.

Scope: preload only, nothing wired into a chat-facing tool yet - no model or
user-authored content reaches declare_function/call_function today.

Verified: 216 backend tests pass (4 new in test_curry_store.py, including a
regression test proving the vendored sandbox fix survived the copy); the 12
pre-existing C/C++/Rust toolchain failures are unrelated and unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -148,6 +148,9 @@ about which of its five layers are load-bearing and which are only a tripwire.
 ### Persistent Storage
 Most data lands in `synapse/memory/memory.db` (SQLite, WAL mode). Tables: memory facts, conversations, messages, app settings. `synapse/memory/store.py` (`PersistentMemoryStore`) owns the schema and all queries. Playbooks are the exception — they live as YAML files in `data/playbooks/` (see Playbook System). `nexus_config.py` defines all paths; it also ensures all required directories exist on import.
 
+### Curry (`synapse/curry_core.py` + `synapse/curry_store.py`)
+`curry_core.py` is vendored, unmodified-except-for-one-fix, from [Athena-Pro/Curry](https://github.com/Athena-Pro/Curry) — an immutable, versioned fact store (constants, functions, model registrations, inference provenance) backed by its own SQLite file (`CURRY_DB` in `nexus_config.py`, separate from `memory.db`). `curry_store.py` opens it into a module-level singleton (`curry_db`) at import time — the same pattern as `memory.store.store` / `playbooks.store.playbook_store` — so it's preloaded and callable (`curry_db.declare_constant(...)`, `curry_db.call_function(...)`, etc.) from anywhere in the backend without extra setup. It ships inside the wheel (`bin/check.sh`'s packaging gate asserts this) and has no external dependencies of its own. Nothing currently wires chat/model-authored content into it — it's available, not yet exposed as an action tool. Re-sync `curry_core.py` from upstream by hand, not by script; see the file's own docstring for what changed and why.
+
 ### Logs & Runtime State
 - `runtime/backend.log`, `runtime/frontend.log`, `runtime/memory.log` — service stdout
 - `runtime/logs/ollama.log`, `runtime/logs/chat.log`