refactor: implement observed capability providers

[rcyw]

Summary

• Introduce the Observation → Policy → Enforcement capability architecture:
  • replace string-based node capabilities with typed observations and atomic snapshots;
  • centralize platform capability derivation, evidence validation, and loss policy;
  • keep extension capabilities typed, namespaced, and separate from platform capabilities.
• Enforce capability correctness across the allocation lifecycle:
  • re-evaluate typed requirements under the PostgreSQL node-row lock;
  • persist placement and create-time evidence with allocation dependencies;
  • reconcile capability loss with allocation-specific verification and fail-stop handling.
• Add observed capability providers and durable recovery:
  • verify cgroup, runtime, filestore, EROFS, and network facts;
  • run bounded runc/runsc conformance self-tests;
  • preserve fresh node heartbeats and summaries while capability providers are warming;
  • reconcile runtime state, rootfs storage, and incomplete teardown after restart.
• Remove obsolete contracts:
  • delete dynamic capability callbacks, boot markers, and arbitrary platform strings;
  • remove compatibility aliases and writable-layer terminology;
  • require coordinated controld, axnoded, proto, SDK, database, and node-state rollout.

Validation

• Continuous integration:
  • Open Source, Repo Assets, Go, Rust, TypeScript, Python, SDK Artifacts, Documentation, Release Contracts, Axrun Gates, Managed Rollout Gate, and DCO passed.
• HK functional acceptance:
  • release axern-hk-20260809104110 completed with 6/6 nodes ready;
  • managed Rollout completed with healthy diagnosis and complete evidence;
  • OCI and Nydus cold/warm 36-service matrices completed with balanced six-node placement;
  • Nydus cold Ready P95 was 1.957s against the 2.5s gate;
  • crash-like axnoded replacement, recovery, cleanup, and post-fault verification passed.
• Runtime cleanup verification:
  • runc/runsc runtime inventories were empty after validation;
  • capability self-test bundles, projections, and writable artifacts were fully removed;
  • no forced-teardown deadlock or cleanup failure remained.

Compatibility

• This is an intentional coordinated breaking change:
  • mixed old/new controld, axnoded, proto, or SDK versions are unsupported;
  • development databases and node-local state must be rebuilt during rollout;
  • legacy capability strings and fallback behavior are not retained.

Closes #42