fix(capsule): make component→root capability merge exhaustive (#1232)

[jvsteiner]

Linked Issue

Closes #1232.

Summary

discovery.rs folded each [[component]].capabilities into the root manifest field-by-field by hand-enumeration, so fields not explicitly listed were silently dropped. The security gate reads only the root, meaning a component-only declaration could appear in astrid capsule show while granting nothing.

Changes

• Add exhaustive CapabilitiesDef::merge_from: allowlists concatenate and flags are OR-ed.
• Destructure the source without .., so adding a capability field fails compilation until its merge behavior is handled.
• Replace the partial discovery merge with the exhaustive helper.
• Add discovery-seam and complete flag/list regressions, including component-only positive grants and preservation of existing root grants.

Verification

• cargo fmt --all -- --check
• cargo test -p astrid-capsule-types merge_from_ -- --nocapture
• cargo test -p astrid-capsule component_level_capabilities_merge_into_root -- --nocapture
• cargo clippy -p astrid-capsule-types -p astrid-capsule --all-features -- -D warnings
• git diff --cached --check

AI / Tool Assistance

Assisted-by: Anthropic Claude: Opus 4.8
Assisted-by: OpenAI Codex: GPT-5

Claude assisted Jamie with the original implementation. Codex independently reviewed the architecture and capability semantics, strengthened the regression coverage, reconciled the patch onto current main, and validated the affected crates. I reviewed the final combined patch and created the GPG-signed, DCO-compliant commit. Jamie and Claude remain credited as co-authors.

Checklist

• Linked to an issue
• CHANGELOG.md updated
• I understand every change in this PR and can explain its design, risks, and validation.
• I reviewed and tested any meaningful tool-generated output included in this PR.
• Every non-bot, non-merge commit has a matching Signed-off-by trailer.

[jvsteiner]

@joshuajbouw ready for review — exhaustive CapabilitiesDef::merge_from so component-level caps (net_connect etc.) stop getting silently dropped (#1232).

[joshuajbouw]

Review outcome: technically worth advancing. The exhaustive capability merge and regression coverage look correct, and the substantive CI jobs are green. Please fix the required PR-template sections and add the changelog entry so the repository checks can pass.