fix(capsule): preserve device attenuation in dispatch

[joshuajbouw]

Linked Issue

Closes #1239

Depends on #1238. Refs #1237 and astrid-runtime/rfcs#36.

Summary

Carries the authenticated device into capsule dispatch so execution and inventory use the same live authority already enforced at the kernel boundary. The change is generic to Astrid and introduces no product-specific role or trust path.

Changes

• resolve one principal/profile/group/device snapshot per stamped event
• reject disabled, malformed, unknown, and revoked identities before matching or grant signalling
• use device-effective capsule:list only for global describe visibility
• activate exact device-effective capsule:access:any for unrestricted execution and candidate expansion
• preserve exact per-principal capsule grants, no-device/Full behavior, and unprincipled lifecycle dispatch
• emit one GrantRequired only for a valid in-view denied match
• preserve legacy dispatch when no access resolver is installed
• add a dedicated device-scope dispatch regression suite

Verification

• cargo fmt --all -- --check
• git diff --check
• focused regressions cover no-device, Full, scoped allow/deny, direct exact-capability authority, explicit capsule grants, disabled/invalid/revoked identities, group snapshot changes, grant signalling, and the no-resolver path
• current CI is fully green, including Linux/macOS tests, Clippy, public API gates, security checks, and Runtime CLI + HTTP

Dependency handling

This PR targets main. Its current diff includes #1238, which must land first; GitHub will then narrow this PR. RFC #36 is design context, not a merge dependency for this fail-closed correction.

Checklist

• Linked to an issue
• CHANGELOG.md updated under [Unreleased]

[Copilot]

Pull request overview

Updates capsule dispatch to carry the authenticated device scope into access resolution so dispatch decisions (candidate expansion, execution gating, and grant signalling) reflect the same attenuated authority enforced at the kernel boundary (Issue #1239 / RFC #36).

Changes:

• Thread device_key_id through dispatcher matching and resolve a single immutable (principal/profile/groups/device-scope) access snapshot per stamped event.
• Enforce fail-closed behavior for disabled/invalid/unknown/revoked identities before interceptor matching and before emitting GrantRequired.
• Add a dedicated regression suite covering device-scoped inventory vs execution authority and legacy no-resolver behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
crates/astrid-capsule/src/dispatcher.rs	Carries device key id into matching, resolves per-event access snapshot, and updates candidate expansion + grant-on-use behavior.
crates/astrid-capsule/src/dispatcher_tests.rs	Updates existing tests to the new find_matching_interceptors signature.
crates/astrid-capsule/src/dispatcher_device_scope_tests.rs	Adds device-scope focused dispatch regression tests (inventory vs execution, invalid identities, legacy path).
crates/astrid-capsule/src/access.rs	Introduces ResolvedCapsuleAccess snapshot and device-scoped capability evaluation for capsule:list and capsule:access:any.
CHANGELOG.md	Documents the security behavior change under [Unreleased].

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.