Add the capability discovery tool with semantic manifest search #27

Shipped on monorepo main in 1b07ec31de. The standing prompt grows by exactly one tool, capability, and installed plugins stay digest-pinned in the local catalog costing zero prompt bytes until a search selects one — pinned by a test that the declared tool set does not grow with catalog size.

Approval keys to the digest and the declared capabilities rather than to a name: no mounts and no hosts auto-runs; read-only mounts ask once and the answer caches against the digest and the capabilities it was given for; hosts or writable mounts ask every time; and with no approver configured anything impure is refused rather than run. Each tier has a test. A search that finds nothing records a capability gap for the registry's gap loop.

On selection the workspace invariant held: no keyword routing. No embedding path exists in this package, so the tool returns the typed catalog candidates and their descriptions and lets the model choose rather than dressing a substring match up as semantics — invocation stays exact-name. That is the one part of the contract not yet met as written ('embedding match over typed manifests'), and it needs an embedding path that does not exist here yet; the same gap is recorded on openagents.com#206's index. 810 CLI tests green.