feat(core): populate passive capability-registry revision 1

[joshuajbouw]

Linked Issue

Closes #1235

Refs #1228, #1233, #1234, and astrid-runtime/rfcs#36.

Summary

Populates the passive 51-entry capability-registry revision 1 on top of #1234.
Existing authorization, wildcard evaluation, persisted state, socket behavior, and
wire contracts remain unchanged.

Changes

• bind all 51 kernel entries to fixed scope, ordered target kinds, delegability,
  privileged status, source, and display danger
• expose the typed revision 1 manifest while keeping the raw ID set private
• freeze all 51 BLAKE3 entry digests and the aggregate manifest digest
• preserve current catalog scope and danger metadata
• require kernel and admin request mappings to resolve to a registered entry
• complete kernel and admin request-variant inventories
• classify every revision 1 ID as primary, secondary, token-authenticated, dormant,
  or mapping-only
• use immutable registry-revision terminology throughout the public API and errors

Verification

• cargo fmt --all -- --check
• cargo metadata --locked --offline --no-deps --format-version 1
• git diff --check
• an independent canonical encoder verified all 51 entry payloads before
  regenerating every domain-separated BLAKE3 vector with b3sum
• aggregate revision 1 manifest digest independently regenerated and checked
• GitHub CI is the execution gate because the local native BLAKE3 build script stalls
  before compiling astrid-core

Checklist

• Linked to an issue
• CHANGELOG.md updated under [Unreleased]
• No evaluator activation or persisted-state migration

[Copilot]

Pull request overview

Populates Astrid’s passive, content-addressed capability registry with the full 51-entry migration baseline, binding each fixed capability ID to immutable authorization semantics and freezing the canonical entry/manifest digests, while keeping current runtime authorization behavior unchanged.

Changes:

• Build and expose the 51-entry migration_baseline_registry() with fixed scope, target kinds, delegability, privilege, provenance, and display danger.
• Add/extend drift tests to ensure every kernel/admin enforcement mapping resolves to a registered baseline entry and that baseline role classifications remain exhaustive/disjoint.
• Freeze and verify golden entry digests and the aggregate manifest digest; update CHANGELOG.md under [Unreleased].

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
crates/astrid-kernel/src/kernel_router/capability_catalog_tests.rs	Updates drift tests to require kernel/admin capability mappings to resolve to a migration-baseline registry entry and adds baseline classification assertions.
crates/astrid-kernel/src/kernel_router/admin/tests.rs	Extends admin request-variant inventory in tests to cover newly added admin request variants.
crates/astrid-core/src/capability_registry/tests.rs	Adds comprehensive tests ensuring the baseline registry definitions, catalog metadata preservation, and frozen digest vectors are stable and verified.
crates/astrid-core/src/capability_registry.rs	Implements the 51-entry migration baseline registry generator, including fixed semantics, display-danger sourcing, and new baseline-definition error variants.
CHANGELOG.md	Documents the new passive migration-baseline semantics and digest freezing under [Unreleased].

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.