feat(registry): capability descriptors for dynamic environment config

**Context:** ROADMAP.md → Capability descriptors

---

## Component

Agent (Python runtime)

## Describe the feature

Structured **metadata per registry asset** declaring:

**Provides:** tool surface, permissions required, resource limits, Cedar actions introduced.

**Requires:** runtime dependencies, network egress domains, minimum compute profile.

Agent runtime uses descriptors to configure the execution environment dynamically—MCP servers, context injection, sandbox permissions—rather than static blueprint lists. Registry is evaluated by Change Manifest **L1** (`tool_needed` validation) and **L5** (knowledge resolution).

## Use case

Static blueprint lists do not scale as asset types grow. Runtime needs machine-readable requirements to provision MCP servers, context injection, and sandbox permissions.

## Proposed solution

1. JSON Schema for `CapabilityDescriptor` stored alongside asset artifact.
2. Resolver validates descriptor at task start; fails closed on mismatch with compute profile.
3. Gateway + Cedar auto-generate allowlists from descriptor actions.
4. Validator in registry publish path.
5. Golden fixtures in `contracts/` or `cdk/test/`.

## Other information

- Child of #246; pairs with extended tool capability tiers draft.
- Design context: `docs/design/COMPUTE.md`.

- [ ] This might be a breaking change

Commencez par ROADMAP.md et docs/design/COMPUTE.md, puis examinez le chemin de publication du registry ainsi que les emplacements contracts/ ou cdk/test/ mentionnés pour les golden fixtures. Le travail proposé couvre le schéma du descripteur, le resolver de task-start, les allowlists de Gateway et Cedar, la validation de publication et les fixtures ; il est terminé lorsque ces éléments prennent en charge une configuration dynamique de l’environnement validée.

Rédigé par le modèle d'indexation à partir du texte de l'issue.