feat(#1435): capability matrix (generated + drift-guarded) + trust-model doc consolidation (#1458)

* feat(#1435): capability matrix (generated + drift-guarded) + trust-model doc consolidation

ADR-1244 Phase 6. Adds the capability matrix reference, generated FROM the committed registry so it
can never drift from the actual capability set:
- scripts/gen-capability-matrix.cjs (--write / --check); --check is a CI drift guard.
- tests/capability-matrix-sync.test.cjs (4 tests): drift guard, buildMatrix==committed, every cap
  present, no placeholders.
- docs/reference/capability-matrix.md regenerated from the registry (release-stable: shows engines.gsd,
  omits the lockstep per-cap version that would churn the file every release).
- Consolidated the duplicate trust-model doc: deleted docs/explanation/the-capability-trust-model.md,
  merged its content into capability-trust-model.md, redirected ~10 references; no stale links remain.
- Diataxis verification (now that gsd capability is a real command): corrected the matrix's third-party
  section — the matrix is the first-party catalogue; the overlay-aware view of installed third-party
  capabilities is 'gsd capability list', not this generated file.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(#1435): Added changeset for the capability matrix reference

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#1435): address code-review — non-vacuous matrix test + generator polish

- capability-matrix-sync.test.cjs: assert the 'security registers a ship:pre gate' precondition
  unconditionally so the extension-point check can never degrade to a vacuous pass on registry drift.
- gen-capability-matrix.cjs: warn (stderr) on an unknown loop point at generation time; rename
  enginesOf -> fmtEngines for consistency with the other fmt* helpers (output unchanged).
- capability-trust-model.md: point the two how-to links at the real files
  (import-a-capability-from-a-url.md, version-a-capability.md) instead of the bare directory.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#1435): backfill changeset PR number → #1458

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

src/capability-lifecycle.cts

@@ -6,7 +6,7 @@
  * from a crash mid-upgrade. The LEDGER WRITE is the commit point for every operation: a crash
  * before it leaves the prior state fully intact; a crash after it is a completed operation.
  *
- * Trust invariants enforced here (see docs/explanation/the-capability-trust-model.md):
+ * Trust invariants enforced here (see docs/explanation/capability-trust-model.md):
  *   - install/upgrade never execute capability code (resolver stages copy-only; we only swap
  *     directories and edit JSON);
  *   - executable surfaces are disclosed and consent is required before anything is promoted

src/capability-loader.cts

@@ -427,7 +427,7 @@ export function loadRegistry(options: LoadRegistryOptions = {}): Registry {
       // the user actually installed+consented to via the lifecycle — a bundle merely dropped on
       // disk with no ledger entry provides declarative surfaces (Phase 2) but is NOT command-
       // dispatchable. (Project-scope ledgers live in the repo tree and are thus only as trustworthy
-      // as the repo — see docs/explanation/the-capability-trust-model.md.)
+      // as the repo — see docs/explanation/capability-trust-model.md.)
       if (families.length > 0 && committedIds.has(id)) commandRoots[id] = capDir;
     }
   }

src/capability-trust.cts

@@ -5,7 +5,7 @@
  * never mutates the filesystem and never performs I/O beyond reading staged files to confirm
  * declared executable artifacts exist. The actual consent decision (yes/no) is passed in by the
  * caller — GSD has no interactive-prompt layer in lib (the runtime/CLI edge owns that), so the
- * gate stays testable and side-effect-free. See docs/explanation/the-capability-trust-model.md.
+ * gate stays testable and side-effect-free. See docs/explanation/capability-trust-model.md.
  *
  * LEAF MODULE — imports ONLY: node:fs, node:path, and ./semver-compare.cjs.
  *