Enforce capability authority at effect boundaries

[bigboateng]

Summary

• add a closed capability vocabulary with kernel-owned authority grants and effect minimums
• bind exact authority and capability projections through prescriptions, admissions, effects, recovery, events, receipts, CLI commands, and SDK requests
• make repository-authored control programs fail closed on unknown, missing, under-declared, or ungranted capabilities
• publish the capability boundary in the generated transition catalog and architecture documentation

This is an intentional flag-day protocol change. It adds no compatibility shims.

Control boundary

Program declarations may narrow capability, but they cannot create authority or weaken the kernel's effect classification. command.execute remains an explicit host-process trust boundary rather than an OS sandbox claim.

Verification

• go test ./...
• go test -race ./...
• go vet ./...
• go build ./cmd/boatstack-helper
• 29 repository-contract and detached-supervision tests
• release-note and installer validation
• git diff --check