feat(capabilities): typed host, service, journal and read-only browser operations

Bounded operations instead of a shell (ADR-0011): service.status,
service.restart and logs.query run systemctl/journalctl from a fixed
allow-list with no shell, a minimal environment, validated unit names and
the unit as the derived policy target; logs mask e-mail and IP addresses
and credential-like values by default. host.disk.usage,
host.memory.status and host.process.list read the kernel directly and
never read command lines. browser.navigate/read/links fetch through the
SSRF-safe client, run no scripts, refuse cross-host redirects, use the
host as the policy target and deliver content as low-trust observations.
Writing browser operations are designed but not registered. The test
harness takes a fake command runner so no test touches a real unit.

internal/capabilities/host/statfs_other.go

@@ -0,0 +1,9 @@
+//go:build !linux
+
+package host
+
+import "errors"
+
+func statfs(string) (uint64, uint64, error) {
+	return 0, 0, errors.New("host.disk.usage is only implemented on Linux")
+}