feat(capabilities): typed host, service, journal and read-only browser operations

Bounded operations instead of a shell (ADR-0011): service.status,
service.restart and logs.query run systemctl/journalctl from a fixed
allow-list with no shell, a minimal environment, validated unit names and
the unit as the derived policy target; logs mask e-mail and IP addresses
and credential-like values by default. host.disk.usage,
host.memory.status and host.process.list read the kernel directly and
never read command lines. browser.navigate/read/links fetch through the
SSRF-safe client, run no scripts, refuse cross-host redirects, use the
host as the policy target and deliver content as low-trust observations.
Writing browser operations are designed but not registered. The test
harness takes a fake command runner so no test touches a real unit.

internal/capabilities/host/statfs_linux.go

@@ -0,0 +1,14 @@
+//go:build linux
+
+package host
+
+import "syscall"
+
+func statfs(path string) (total, free uint64, err error) {
+	var st syscall.Statfs_t
+	if err := syscall.Statfs(path, &st); err != nil {
+		return 0, 0, err
+	}
+	bs := uint64(st.Bsize) // #nosec G115 -- block size is positive
+	return st.Blocks * bs, st.Bavail * bs, nil
+}