Capability-secure core (compile error E0404)

All authority-bearing entry points: network, filesystem, process, FFI, environment access: now require explicit Cap<T> capabilities. Only the entry module can mint root capabilities; every other module must receive them as arguments. Compile error E0404 enforces this unconditionally. The entire conformance suite threads capabilities. Combined with the five @literal injection rules, kern's security model covers both ambient authority and injection attacks at compile time: two of the three classic attack surfaces (the third, memory safety, is mitigated by the GC and stack guards).