feat(ontology): join capabilities to the commands that invoke them

Capabilities and commands were separate catalogues that never met. An agent
read one to learn what simon can do and the other to learn how to ask, with
nothing checking the two described the same program.

`Capability::command` names the command that exercises each one, and
`every_command_a_capability_names_exists` runs `simon describe --commands`
and checks every one against the binary. A catalogue that tells an agent how
to invoke something and is wrong about it is worse than one that says
nothing.

The join immediately reported something worth knowing: the intrusion
detectors have no command. They are real, tested against this machine's live
socket table, and reachable from nothing a person or an agent can type.
Nobody had noticed because the two catalogues had never been compared.
`capabilities_with_no_command_are_named` prints the stranded set and asserts
the detection surface is wired all-or-nothing, so a half-wired surface cannot
appear either.

MCP is deliberately in that set: it is spoken rather than typed.

Verified the check bites: renaming `cli cpu` to `cli processor` in the
mapping fails with "the binary does not accept it".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>