Worker Loader: support a Fetcher for `globalOutbound` (or capability stubs in `env`)

Worker Loader currently rejects a Fetcher for `globalOutbound` ("broker is not implemented yet"), and `env` accepts plain JSON only. Both marked not-yet-implemented in `js.rs::op_loader_load`, so a loaded worker cannot receive any capability from its parent.

**Use case:** multi-tenant site functions. A Durable Object cell per site loads that site's user code via `env.LOADER.get()`. The cell owns the site's storage and wants to hand the loaded code a scoped capability to it. With no stub in `env` and no outbound broker, the only bridge is inherited ambient egress plus HTTP calls back into the fleet's own router with a token, which works but gives the loaded code full network access instead of a narrow capability.

Either mechanism would close this:

- `globalOutbound: fetcher` so the parent intercepts the loaded worker's `fetch()` (upstream's intended pattern), or
- capability stubs in `env` (a service/DO stub).

Tested on 0.4.0, `CELLD_WORKER_LOADER=LOADER`.

Start with js.rs::op_loader_load and inspect the not-yet-implemented globalOutbound and env paths. Choose and define one supported capability mechanism, then verify that a loaded worker receives the intended scoped capability without relying on unrestricted ambient egress; the issue does not name a test or additional file.

Written by the indexing model from the issue text.