fix(capsule): make component→root capability merge exhaustive (#1232)

[jvsteiner]

Closes #1232.

Problem

discovery.rs folds each [[component]].capabilities into the root
manifest.capabilities field-by-field, by hand-enumeration — so any field
not explicitly listed is silently dropped. The security gate reads only the
root, so a component-only declaration of a forgotten field grants nothing, with
no error or warning (it still shows up in astrid capsule show).

Fields the old merge dropped: net_connect, uplink, kv, identity,
allow_persistent, allow_prompt_injection (and bind_workers once the
run-loop concurrency work lands). Concretely: a capsule declaring net_connect
at the component level couldn't open the outbound connections it asked for —
easy to lose an hour to.

Fix

Replace the enumerated merge with an exhaustive
CapabilitiesDef::merge_from(&mut self, other) (allowlists concatenated, flags
OR-ed). It destructures the source struct with no .. rest pattern, so
adding a field to CapabilitiesDef fails to compile there until it's handled —
this class of silent-drop bug can't recur.

discovery.rs now just calls manifest.capabilities.merge_from(caps).

Tests

• merge_from_unions_every_field — two fully-populated (no ..Default) structs;
  asserts every field unions, and the literals are themselves a compile-time
  reminder when a field is added.
• component_level_capabilities_merge_into_root — the discovery-seam regression:
  a component-only net_connect (the field the old merge dropped) surfaces in
  the root manifest.

cargo test -p astrid-capsule-types -p astrid-capsule green; clippy clean; rustfmt applied.

🤖 Generated with Claude Code

[jvsteiner]

@joshuajbouw ready for review — exhaustive CapabilitiesDef::merge_from so component-level caps (net_connect etc.) stop getting silently dropped (#1232).