Feat v0.8.2 capability negotiation (#69)

Extensions declare environment requirements via capabilities.required and
capabilities.optional in their manifest. The kernel validates at install
time — required capabilities reject with HTTP 422 and rollback, optional
capabilities log a warning. Runtime query via settings.has_capability().
Admin endpoint GET /api/v1/admin/capabilities re-probes live.

Detected capabilities: postgres, pgvector, object_storage, s3, workspace.

18 new tests, all passing with -race.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/sandbox/settings_module.go

@@ -11,6 +11,7 @@ package sandbox
 // Starlark API:
 //   val = settings.get("key")            # returns string, number, bool, or None
 //   val = settings.get("key", "default") # returns default if key not set
+//   ok  = settings.has_capability("pgvector")  # returns True or False
 
 import (
 	"context"
@@ -24,12 +25,28 @@ import (
 // BuildSettingsModule creates the "settings" Starlark module for a package.
 // It resolves the three-tier cascade (global → team → user) respecting
 // the user_overridable flag from the package manifest.
-func BuildSettingsModule(ctx context.Context, stores store.Stores, packageID, userID, teamID string) *starlarkstruct.Module {
+func BuildSettingsModule(ctx context.Context, stores store.Stores, packageID, userID, teamID string, capabilities map[string]bool) *starlarkstruct.Module {
 	return MakeModule("settings", starlark.StringDict{
-		"get": starlark.NewBuiltin("settings.get", settingsGet(ctx, stores, packageID, userID, teamID)),
+		"get":            starlark.NewBuiltin("settings.get", settingsGet(ctx, stores, packageID, userID, teamID)),
+		"has_capability": starlark.NewBuiltin("settings.has_capability", hasCapability(capabilities)),
 	})
 }
 
+// hasCapability returns a Starlark builtin that checks whether a named
+// environment capability is available.  Read-only, no permission needed.
+func hasCapability(caps map[string]bool) func(*starlark.Thread, *starlark.Builtin, starlark.Tuple, []starlark.Tuple) (starlark.Value, error) {
+	return func(_ *starlark.Thread, _ *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+		var name string
+		if err := starlark.UnpackPositionalArgs("settings.has_capability", args, kwargs, 1, &name); err != nil {
+			return nil, err
+		}
+		if caps == nil {
+			return starlark.False, nil
+		}
+		return starlark.Bool(caps[name]), nil
+	}
+}
+
 func settingsGet(ctx context.Context, stores store.Stores, packageID, userID, teamID string) func(*starlark.Thread, *starlark.Builtin, starlark.Tuple, []starlark.Tuple) (starlark.Value, error) {
 	return func(_ *starlark.Thread, _ *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
 		var key string