security: add the capability and policy layer as the only path to action

Phase 12 (ADR-0005). Capabilities are registered in code with parameter
schemas, risk classes and default effects; sudo_shell and delete_database
are locked to DENY and cannot be relaxed. Policies are scoped globally or
per mind with capability, target glob, action kind and optional hour
window; evaluation is deterministic, most specific wins, and ties go to
the stricter effect. Invoke is the single entry point: it refuses
dreaming and replay contexts, validates parameters (unknown keys, non
http URLs and path traversal rejected), evaluates policy and session
grants, hashes the exact request and records a policy_decision event.
ALLOW executes with timeout and panic isolation and turns textual output
into a tool-trust observation; ASK creates an approval request bound to
the hash with an alert notification; DENY is counted and recorded.

Operators approve once, approve for a time-boxed session grant, deny
with a note, or modify parameters (re-validated, re-hashed, original
kept in the append-only decision log). The self-model's capability list
is recomputed from effective policy on start and on every policy change.
The act process maps fetch requests to http.fetch and the action handler
invokes through the layer; replies report capabilities and outcomes.

Policy matrix and approval centre pages, dashboard count, API, CLI
(approvals, policy, invoke) and docs/capabilities.md.

internal/brain/process.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/andydixon/noema/internal/attention"
 	"github.com/andydixon/noema/internal/beliefs"
+	"github.com/andydixon/noema/internal/capabilities"
 	"github.com/andydixon/noema/internal/goals"
 	"github.com/andydixon/noema/internal/llm/prompts"
 	"github.com/andydixon/noema/internal/llm/router"
@@ -94,14 +95,15 @@ func (s *State) AllowLLM() bool {
 
 // Services are read handles processes may use. Extended per phase.
 type Services struct {
-	Events      EventReader
-	Memory      *memory.Store
-	Beliefs     *beliefs.Store
-	LLM         *router.Router
-	Prompts     *prompts.Store
-	Goals       *goals.Store
-	Motivation  *motivation.Store
-	Predictions *predictions.Store
+	Events       EventReader
+	Memory       *memory.Store
+	Beliefs      *beliefs.Store
+	LLM          *router.Router
+	Prompts      *prompts.Store
+	Goals        *goals.Store
+	Motivation   *motivation.Store
+	Predictions  *predictions.Store
+	Capabilities *capabilities.Service
 }
 
 // EventReader is the subset of the event store processes may call.