feat(canopy): capability descriptors with semantics and typed params

[passcod]

🤖 Reworks pgro's canopy integration to advertise intents as capability descriptors, matching canopy's new managed-restore control plane (canopy#311).

What changed

Bumps bestool-canopy to 0.6.1 and registers intents as descriptors — each a name, human description, the canopy semantics it opts into, and a typed parameter schema — via the generated restore-capabilities client method, replacing the old bare intent-name list. The 0.6.x client bakes the base URL in at construction and exposes generated endpoint methods; several wire types moved under bestool_canopy::schema.

Two intents replace the previous three:

• verify — semantics [check, once], no params (unchanged ephemeral snapshot check; once lets canopy self-suppress a verified snapshot).
• analytics — semantics [check, url], parametrised, collapsing the former analytics-dev and analytics-dbt. The dev/dbt distinction is now the persistent_schemas param rather than two intents.

analytics params, resolved per declaration by canopy and mapped onto the replica CR:

Param	Type	Default	CR field
minimum_ttl	duration	2h	minimumTtl
switchover_grace	duration	2m	switchoverGracePeriod
storage_size_maximum	bytes	—	storageSizeMaximum
persistent_schemas	text (comma-sep)	—	persistentSchemas
expose	boolean	false	tailscale Service annotations

For the url semantic, an exposed replica's tailnet URL (https://infra-replica-{name}.<magic-dns-suffix>) is looked up from the tailscale sidecar LocalAPI (suffix cached) and attached to the verification health_details.

Notes

• No CRD spec change — params map onto existing CR fields, so no readme tables to update.
• The tailnet MagicDNS suffix is resolved from the tailscale sidecar's LocalAPI over a shared unix socket (/var/run/tailscale/tailscaled.sock, an emptyDir shared with the sidecar; path via PGRO_TAILSCALED_SOCKET). Status reads over the socket need no special identity. URL reporting is best-effort and degrades to omitting the link if the socket is absent/unreachable.
• The old analytics-dev / analytics-dbt intent names are retired; existing declarations must be re-declared as analytics (replicas were disabled in canopy ahead of this).