Extensions declare environment requirements via capabilities.required and
capabilities.optional in their manifest. The kernel validates at install
time — required capabilities reject with HTTP 422 and rollback, optional
capabilities log a warning. Runtime query via settings.has_capability().
Admin endpoint GET /api/v1/admin/capabilities re-probes live.
Detected capabilities: postgres, pgvector, object_storage, s3, workspace.
18 new tests, all passing with -race.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
