feat(capabilities): metadata, frozen registry, scoped grants and requests

- Capabilities declare access (read/write, unknown fails closed as
  write), side effects, idempotency, timeout, cost estimate and the trust
  of their output (web content is low trust). A capability may derive its
  policy target from its parameters; a disagreeing target is refused, and
  approvals whose modified parameters change the target are refused.
- The registry is frozen at start-up; registration afterwards panics.
- Invocation.RequireApproval turns ALLOW into ASK for commitments; it can
  only tighten, and scoped grants never satisfy it.
- Scoped grants (migration 0025): capability, target and parameter globs,
  access, expiry of at most seven days and an optional operation count
  consumed atomically; applied only where policy says ASK. A sweep marks
  lapsed grants and refreshes the self-model, which now lists live grants.
- Capability requests carry scope, duration, operation cap, reason,
  evidence, risk, mitigation, fallback, alternatives and explicit decision
  history; they batch per intention, are capped per mind (operator
  attention budget) and can be decided only by a named person. Component
  names are refused as deciders, for approvals too, and as usernames.
- API routes, OpenAPI entries, scheduler sweeps and approval-centre
  sections for requests and temporary grants.

internal/security/actors/actors.go

@@ -0,0 +1,25 @@
+// Package actors distinguishes people from Noema's own components in the
+// "by" and "actor" fields of decisions. Authority-bearing decisions
+// (approvals, grants, capability requests) must name a person; a name that
+// an internal component writes is refused, so no cognitive process can
+// approve its own request by writing a plausible decider.
+package actors
+
+import "strings"
+
+// Components are the names internal processes use as sources or actors.
+var Components = []string{"mind", "brain", "planning", "volition", "cognition", "capabilities", "noema", "system", "dream", "replay", "experiment", "scheduler", "agency", "research"}
+
+// IsPerson reports whether name can stand for a person making a decision.
+func IsPerson(name string) bool {
+	n := strings.ToLower(strings.TrimSpace(name))
+	if n == "" || strings.Contains(n, ":") {
+		return false
+	}
+	for _, c := range Components {
+		if n == c || strings.HasPrefix(n, c+".") {
+			return false
+		}
+	}
+	return true
+}