Keyring capability configuration/introspection

Extracted as an independent concern from #114

The motivation here is to push further with our "correct by construction" tenet: provide ways to encode more of the intention when creating keyrings ("I want all my data keys to be generated by THIS keyring") and therefore catch more misconfigurations at initialization time instead of runtime ("so raise an error if I provide it as a non-generating keyring in a multi-keyring, since by definition that must always fail")

Tightly coupled with decryption contracts (#131), since what we really want is a way to introspect on the nature of the contracts written or fulfilled by a keyring, to make conclusions about whether a given keyring can ever succeed.

Start by reading the related issues #114 and #131 to understand the extracted concern and its decryption-contract dependency. The issue describes keyring configuration, capability introspection, and initialization-time validation, but it does not identify files, tests, or a concrete completion boundary; those need to be established before implementation.

Written by the indexing model from the issue text.