feat(core): populate passive capability-registry revision 1

[joshuajbouw]

Linked Issue

Closes #1235

Refs #1228, #1233, #1234, and astrid-runtime/rfcs#36.

Summary

Populates the passive 51-entry capability-registry revision 1 on top of the
primitives merged in #1234. Existing authorization, wildcard evaluation,
persisted state, socket behavior, and wire contracts remain unchanged.

Changes

• bind all 51 kernel entries to fixed scope, ordered target kinds, delegability,
  privileged status, source, and display danger
• expose the typed revision 1 manifest while keeping the raw ID set private
• freeze all 51 BLAKE3 entry digests and the aggregate manifest digest
• preserve current catalog scope and danger metadata
• require kernel and admin request mappings to resolve to a registered entry
• complete kernel and admin request-variant inventories
• share one complete admin-request test inventory across the mapping and registry suites
• append new public error variants without changing existing implicit discriminants
• classify every revision 1 ID as primary, secondary, token-authenticated,
  dormant, or mapping-only
• use immutable registry-revision terminology throughout the public API and errors

Adding a future live capability remains supported. The catalog/count/mapping
checks fail until a new registry revision is introduced; revision 1 itself is
never silently expanded.

Verification

• cargo fmt --all -- --check
• cargo metadata --locked --offline --no-deps --format-version 1
• git diff --check origin/main..HEAD
• all rebased commits and CI follow-ups retain valid GPG signatures
• an independent canonical encoder verified all 51 entry payloads before
  regenerating every domain-separated BLAKE3 vector with b3sum
• aggregate revision 1 manifest digest independently regenerated and checked
• Linux and macOS tests, Clippy, Runtime CLI + HTTP, MSRV, wasm, OpenAPI, audit, and CodeQL pass at ce515d91
• 5f9dc964 preserves every existing AuthorityRegistryError discriminant; public-API compatibility is rerunning
• the local native build repeatedly stalls in dependency compilation without a Rust diagnostic; GitHub CI remains the execution gate

Checklist

• Linked to an issue
• CHANGELOG.md updated under [Unreleased]
• No evaluator activation or persisted-state migration

[Copilot]

Pull request overview

This PR populates the previously-frozen passive capability-registry revision 1 by assigning fixed authorization semantics (scope, target kinds, delegability, privileged status, provenance) to the 51 normative capability IDs, and adds drift-gating tests to ensure kernel/admin enforcement mappings and role classifications cannot diverge from the registry.

Changes:

• Introduces a typed revision-1 registry manifest builder in astrid-core, including fixed semantics and explicit errors for missing definitions/metadata.
• Updates kernel drift tests to validate that all kernel/admin required-capability mappings resolve to registered revision-1 entries, and that every revision-1 ID has exactly one enforcement-role classification.
• Extends request-variant inventories (kernel + admin) and adds golden digest-vector tests to freeze per-entry and aggregate registry digests.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
crates/astrid-kernel/src/kernel_router/capability_catalog_tests.rs	Switches drift checks from catalog coverage to registry-revision coverage; adds enforcement-role classification completeness test.
crates/astrid-kernel/src/kernel_router/admin/tests.rs	Expands admin request-variant inventory to include newer variants for mapping/exhaustiveness tests.
crates/astrid-core/src/capability_registry/tests.rs	Adds tests asserting revision-1 registry definitions, preserved catalog metadata, and stable per-entry + aggregate digests.
crates/astrid-core/src/capability_registry.rs	Implements revision-1 registry manifest construction with fixed semantics and display metadata resolution; adds new error variants.
CHANGELOG.md	Documents the revision-1 capability-registry semantic population under [Unreleased].

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.