feat(capabilities): metadata, frozen registry, scoped grants and requests

- Capabilities declare access (read/write, unknown fails closed as
  write), side effects, idempotency, timeout, cost estimate and the trust
  of their output (web content is low trust). A capability may derive its
  policy target from its parameters; a disagreeing target is refused, and
  approvals whose modified parameters change the target are refused.
- The registry is frozen at start-up; registration afterwards panics.
- Invocation.RequireApproval turns ALLOW into ASK for commitments; it can
  only tighten, and scoped grants never satisfy it.
- Scoped grants (migration 0025): capability, target and parameter globs,
  access, expiry of at most seven days and an optional operation count
  consumed atomically; applied only where policy says ASK. A sweep marks
  lapsed grants and refreshes the self-model, which now lists live grants.
- Capability requests carry scope, duration, operation cap, reason,
  evidence, risk, mitigation, fallback, alternatives and explicit decision
  history; they batch per intention, are capped per mind (operator
  attention budget) and can be decided only by a named person. Component
  names are refused as deciders, for approvals too, and as usernames.
- API routes, OpenAPI entries, scheduler sweeps and approval-centre
  sections for requests and temporary grants.

migrations/0025_capability_negotiation.up.sql

@@ -0,0 +1,57 @@
+-- Scoped temporary grants and structured capability requests (PLAN §8.2 item 9).
+-- Grants are operator decisions: expiring, optionally counted, restricted by
+-- target, parameters and access. Requests are what a mind asks for; only an
+-- operator route can decide them.
+
+CREATE TABLE capability_grants (
+  id                 uuid PRIMARY KEY,
+  mind_id            uuid NOT NULL REFERENCES minds(id),
+  capability         text NOT NULL,
+  target_pattern     text NOT NULL DEFAULT '*',
+  param_constraints  jsonb NOT NULL DEFAULT '{}'::jsonb,   -- parameter name → glob the value must match
+  access             text NOT NULL DEFAULT 'read' CHECK (access IN ('read','write')),
+  max_operations     integer CHECK (max_operations IS NULL OR max_operations > 0),
+  used_operations    integer NOT NULL DEFAULT 0 CHECK (used_operations >= 0),
+  expires_at         timestamptz NOT NULL,
+  granted_by         text NOT NULL,
+  request_id         uuid,
+  note               text NOT NULL DEFAULT '',
+  revoked_at         timestamptz,
+  revoked_by         text NOT NULL DEFAULT '',
+  expiry_notified_at timestamptz,
+  created_at         timestamptz NOT NULL DEFAULT now(),
+  CHECK (max_operations IS NULL OR used_operations <= max_operations)
+);
+CREATE INDEX capability_grants_mind_idx ON capability_grants (mind_id, capability) WHERE revoked_at IS NULL;
+
+CREATE TABLE capability_requests (
+  id                uuid PRIMARY KEY,
+  mind_id           uuid NOT NULL REFERENCES minds(id),
+  capability        text NOT NULL,
+  target_pattern    text NOT NULL DEFAULT '*',
+  param_constraints jsonb NOT NULL DEFAULT '{}'::jsonb,
+  access            text NOT NULL DEFAULT 'read' CHECK (access IN ('read','write')),
+  duration_seconds  integer NOT NULL CHECK (duration_seconds > 0 AND duration_seconds <= 604800),
+  max_operations    integer CHECK (max_operations IS NULL OR max_operations > 0),
+  reason            text NOT NULL,
+  evidence          jsonb NOT NULL DEFAULT '[]'::jsonb,
+  risk              text NOT NULL DEFAULT '',
+  mitigation        text NOT NULL DEFAULT '',
+  fallback          text NOT NULL DEFAULT '',
+  alternatives      jsonb NOT NULL DEFAULT '[]'::jsonb,
+  history           jsonb NOT NULL DEFAULT '{}'::jsonb,    -- explicit past decisions on this capability, for the operator
+  intention_id      uuid,
+  plan_id           uuid,
+  step_id           uuid,
+  batch_key         text NOT NULL DEFAULT '',
+  status            text NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','granted','denied','expired','withdrawn')),
+  decided_by        text NOT NULL DEFAULT '',
+  decision_note     text NOT NULL DEFAULT '',
+  decided_at        timestamptz,
+  grant_id          uuid REFERENCES capability_grants(id),
+  event_id          uuid,
+  expires_at        timestamptz NOT NULL,
+  created_at        timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX capability_requests_status_idx ON capability_requests (status, created_at DESC);
+CREATE INDEX capability_requests_mind_idx ON capability_requests (mind_id, created_at DESC);