feat(capabilities): metadata, frozen registry, scoped grants and requests

- Capabilities declare access (read/write, unknown fails closed as
  write), side effects, idempotency, timeout, cost estimate and the trust
  of their output (web content is low trust). A capability may derive its
  policy target from its parameters; a disagreeing target is refused, and
  approvals whose modified parameters change the target are refused.
- The registry is frozen at start-up; registration afterwards panics.
- Invocation.RequireApproval turns ALLOW into ASK for commitments; it can
  only tighten, and scoped grants never satisfy it.
- Scoped grants (migration 0025): capability, target and parameter globs,
  access, expiry of at most seven days and an optional operation count
  consumed atomically; applied only where policy says ASK. A sweep marks
  lapsed grants and refreshes the self-model, which now lists live grants.
- Capability requests carry scope, duration, operation cap, reason,
  evidence, risk, mitigation, fallback, alternatives and explicit decision
  history; they batch per intention, are capped per mind (operator
  attention budget) and can be decided only by a named person. Component
  names are refused as deciders, for approvals too, and as usernames.
- API routes, OpenAPI entries, scheduler sweeps and approval-centre
  sections for requests and temporary grants.

tests/harness/harness.go

@@ -64,8 +64,21 @@ type Harness struct {
 
 const AdminPass, ObserverPass = "administrator-pass-1", "observer-pass-12345"
 
+// Options adjust the assembled daemon for a test.
+type Options struct {
+	// Capabilities are extra test capabilities registered before the
+	// registry is frozen.
+	Capabilities []capabilities.Capability
+}
+
 // Start builds and serves a daemon for one test.
 func Start(t *testing.T) *Harness {
+	t.Helper()
+	return StartWith(t, Options{})
+}
+
+// StartWith builds a daemon with options.
+func StartWith(t *testing.T, o Options) *Harness {
 	t.Helper()
 	pool := storage.TestPool(t, migrations.FS)
 	ctx := context.Background()
@@ -85,6 +98,10 @@ func Start(t *testing.T) *Harness {
 	for _, c := range capabilities.Builtins() {
 		capReg.Add(c)
 	}
+	for _, c := range o.Capabilities {
+		capReg.Add(c)
+	}
+	capReg.Freeze()
 	deps.Capabilities = &capabilities.Service{Registry: capReg, DB: pool, Events: deps.Events, Log: log}
 	deps.Integrations = &integrations.Manager{Store: integrations.NewStore(pool), Events: deps.Events, Graph: deps.Graph, Log: log, Pollers: map[integrations.Kind]integrations.Poller{}}
 	deps.Dreaming = &dreaming.Service{DB: pool, Memory: deps.Memory, Beliefs: deps.Beliefs, Events: deps.Events, Log: log}