feat(capabilities): typed host, service, journal and read-only browser operations

Bounded operations instead of a shell (ADR-0011): service.status,
service.restart and logs.query run systemctl/journalctl from a fixed
allow-list with no shell, a minimal environment, validated unit names and
the unit as the derived policy target; logs mask e-mail and IP addresses
and credential-like values by default. host.disk.usage,
host.memory.status and host.process.list read the kernel directly and
never read command lines. browser.navigate/read/links fetch through the
SSRF-safe client, run no scripts, refuse cross-host redirects, use the
host as the policy target and deliver content as low-trust observations.
Writing browser operations are designed but not registered. The test
harness takes a fake command runner so no test touches a real unit.

tests/harness/harness.go

@@ -23,6 +23,7 @@ import (
 	"github.com/andydixon/noema/internal/beliefs"
 	"github.com/andydixon/noema/internal/brain"
 	"github.com/andydixon/noema/internal/capabilities"
+	"github.com/andydixon/noema/internal/capabilities/host"
 	"github.com/andydixon/noema/internal/cognition"
 	"github.com/andydixon/noema/internal/config"
 	"github.com/andydixon/noema/internal/consolidation"
@@ -66,6 +67,9 @@ const AdminPass, ObserverPass = "administrator-pass-1", "observer-pass-12345"
 
 // Options adjust the assembled daemon for a test.
 type Options struct {
+	// HostRunner backs the host and service capabilities. Nil leaves them
+	// registered but failing, so no test touches a real systemd unit.
+	HostRunner host.Runner
 	// Capabilities are extra test capabilities registered before the
 	// registry is frozen.
 	Capabilities []capabilities.Capability
@@ -98,6 +102,9 @@ func StartWith(t *testing.T, o Options) *Harness {
 	for _, c := range capabilities.Builtins() {
 		capReg.Add(c)
 	}
+	for _, c := range host.Capabilities(host.Options{Runner: o.HostRunner}) {
+		capReg.Add(c)
+	}
 	for _, c := range o.Capabilities {
 		capReg.Add(c)
 	}