feat(registry): capability descriptors for dynamic environment config

**Context:** ROADMAP.md → Capability descriptors

---

## Component

Agent (Python runtime)

## Describe the feature

Structured **metadata per registry asset** declaring:

**Provides:** tool surface, permissions required, resource limits, Cedar actions introduced.

**Requires:** runtime dependencies, network egress domains, minimum compute profile.

Agent runtime uses descriptors to configure the execution environment dynamically—MCP servers, context injection, sandbox permissions—rather than static blueprint lists. Registry is evaluated by Change Manifest **L1** (`tool_needed` validation) and **L5** (knowledge resolution).

## Use case

Static blueprint lists do not scale as asset types grow. Runtime needs machine-readable requirements to provision MCP servers, context injection, and sandbox permissions.

## Proposed solution

1. JSON Schema for `CapabilityDescriptor` stored alongside asset artifact.
2. Resolver validates descriptor at task start; fails closed on mismatch with compute profile.
3. Gateway + Cedar auto-generate allowlists from descriptor actions.
4. Validator in registry publish path.
5. Golden fixtures in `contracts/` or `cdk/test/`.

## Other information

- Child of #246; pairs with extended tool capability tiers draft.
- Design context: `docs/design/COMPUTE.md`.

- [ ] This might be a breaking change

Inizia da ROADMAP.md e docs/design/COMPUTE.md, quindi ispeziona il percorso di pubblicazione del registry e le posizioni contracts/ o cdk/test/ menzionate per i golden fixtures. Il lavoro proposto comprende lo schema del descrittore, il resolver di task-start, le allowlist di Gateway e Cedar, la validazione della pubblicazione e i fixtures; il lavoro è completo quando questi componenti supportano una configurazione dinamica dell’ambiente validata.

Scritto dal modello di indicizzazione a partire dal testo della issue.