fix(cowshed): coordinator.resize joins the capability allowlist

The resize verb dispatched through the coordinator but the server
refused it before routing - the allowlist entry was the missing half
of 94a40ed34.