feat(ontology): a capability schema over every surface, with tests derived from it

The reading ontology says what a value means. It says nothing about whether
simon can produce it on this machine, so an agent that knows
`gpu.0.temperature` is degrees Celsius still cannot tell that asking is
futile on macOS. The README said so in prose, which is the wrong medium for
a reader that is not a person.

`ontology::capability` declares every surface — readings, settings, tuning,
detection, interfaces — per platform, with the evidence for each claim.

`Support::Unverified` is what makes it honest rather than promotional: code
that compiles and has never run on real hardware is not "implemented". This
project ships several such paths and the Linux profile writers are still
among them. Calling that implemented would be the same error as reporting a
nominal clock as a measured one.

The tests are derived from the catalogue rather than written beside it,
because a hand-kept list is a second copy that drifts — which this project
has now watched happen with a rust-version, a README, and a metric registry.
`tests/capability_conformance.rs` checks both directions:

- registered apply handlers and declared settings are the same set
- every detection rule the source emits is in `ids::RULES`, and every
  declared rule is emitted
- every ontology domain declares its reading support
- readings claimed usable here must actually resolve in a live snapshot
- readings claimed unimplemented here must produce nothing — the test that
  catches a stale pessimistic claim, which is worse than a stale optimistic
  one because an agent plans around an absence that is not there
- the README and the catalogue must agree about macOS GPU

Verified both controls fail: undeclaring `file.modified` fails the rule
check, and claiming macOS has a GPU reader fails the agreement check.

866 tests green across every suite, on default features and with `vault`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>