Govern self-authored tools, skills, and reusable plans as capabilities

## Origin

Deferred from the MVP proposed as a fresh realization of #485.

## Goal

Allow agents to create, test, share, repair, and revoke tools, skills, and reusable plans safely.

## Scope

- One immutable, versioned `Capability` contract for tools, skills, and reusable plans.
- Lifecycle: `draft -> quarantined -> candidate -> trusted -> deprecated/revoked`.
- Input/output schemas, exact implementation hash, dependency lock, test/evidence bundle, ownership, and invocation history.
- Enforced authority manifests for network, filesystem, subprocess, secrets, cost, and side effects; child authority may narrow but never widen.
- Independent, use-based qualification; authors cannot approve their own capability.
- Bug reports linked to exact invocations and expected/observed artifacts.
- New-version repair and revocation rather than mutation or historical deletion.
- Idempotency and compensation declarations for external effects.

## Acceptance criteria

- [ ] A run can author a capability in quarantine and cannot invoke it as trusted before independent qualification.
- [ ] Qualification executes real tests inside the declared sandbox.
- [ ] Authority widening is rejected and recorded.
- [ ] A failing invocation can trigger independent triage and evidence-based revocation.
- [ ] Historical runs remain replayable/auditable after revocation.