Add Actions-first failure capsules

[zozo123]

Summary

• Add a local-first crabbox capsule command group for capturing GitHub Actions failures into capsule.yaml manifests.
• Replay capsules through the existing crabbox run path, with inspect/promote helpers and bounded local evidence.
• Document the Actions-first capsule contract without adding worker, registry, RL, emulator, or hardware scope.

Test plan

• go test ./...
• npm run docs:check
• Captured 10 recent failed openclaw/crabbox Actions runs into local capsule directories.

[zozo123]

E2E smoke coverage for this PR:

• Captured and inspected a real failed GitHub Actions run from openclaw/openclaw (25624967663) into a local capsule. Verified repo/run metadata, failed job/step, bounded logs/failed.log, and sha256: log digest.
• Exercised signature-aware replay classification with a local fake delegated provider: matching signature recorded fail_reproduced; mismatched signature recorded fail_new and returned nonzero.
• Verified strict --job handling: a nonexistent job now fails clearly instead of silently capturing the wrong job.

Validation already passed:

• go test ./internal/cli
• go test ./...
• npm run docs:check

Residual risk: the replay smoke avoided paid/remote sandbox cost. It proves the capsule capture, manifest, replay classification, and delegated-provider error parsing paths, but not real provider networking.