feat(cli): add capability scaffold command

[nucleuskit]

Summary

• Add a first-class nucleus capability add CLI package with structured command wiring, human/JSON output, --dry-run, --force, conflict detection, and relative changed-file reporting.
• Add an internal capability catalog so plan provider hints and capability add support stay aligned.
• Replace root-level inline capability logic with thin root command mounting.
• Add regression coverage for redis scaffolds, sql/postgres scaffolds, dry-run behavior, conflict handling, forced overwrites, unsupported providers, runtime capability rejection, plan-to-add compatibility, and root --dir wiring.
• Advance the cap and bridge submodule pointers to their feat/capability work for this branch.

Motivation

plan could suggest commands such as nucleus capability add redis --provider redis, but the CLI did not previously provide a maintainable first-class implementation. The earlier capability logic was also concentrated in root.go, which made the root command carry provider catalogs, manifest patching, template rendering, and file writes.

This PR makes capability scaffolding match the structure used by other Nucleus subcommands while keeping the kernel boundaries explicit.

Affected Areas

• cmd/nucleus/internal/capability: new command package for capability scaffold orchestration.
• cmd/nucleus/internal/capcatalog: shared internal capability/provider metadata for CLI planning and scaffolding.
• cmd/nucleus/internal/plan: uses the shared catalog for capability task planning.
• cmd/nucleus/internal/root: mounts the capability command without carrying command logic.
• cap / bridge: submodule pointer updates for the corresponding capability branch work.

Compatibility

• Keeps the intended command shape: nucleus capability add <capability> --provider <provider>.
• Adds optional --json, --pretty, --dry-run, and --force flags.
• Emits nucleus.capability_result JSON with stable fields for status, summary, changed files, diagnostics, and next steps.
• Uses structured YAML updates for nucleus.yaml and writes provider metadata under nucleus.providers.
• Rejects runtime capabilities such as http, grpc, and worker in capability add; those remain contract/runtime scaffolding concerns handled by init and gen.

Validation

• rtk go test ./...
  • Passed: 113 tests / 16 packages.
• rtk go test ./... -race -count=1
  • Passed: 113 tests / 16 packages.
• rtk go test ./... in contract
  • Passed: 92 tests / 10 packages.
• rtk go run ./cmd/nucleus verify --dir example/hello-http --json
  • Passed: 7/7 verification steps.

Review Notes

• The repository root still has no nucleus.yaml, so root-level nucleus validate --dir . and nucleus verify --dir . are not meaningful for this kernel checkout. Validation uses the runnable example/hello-http service instead.
• Initial sandboxed test attempts hit macOS sandbox restrictions around temporary file operations and httptest port binding. The same test commands passed after rerunning outside the restricted sandbox.
• The root commit title is broader than the CLI-only portion because this branch also advances cap and bridge submodule pointers. The PR scope above is the authoritative review scope.