Fix kb.capabilities OpenClaw compat source

[Copilot]

The failing ci / test (py3.12) (pull_request) job came from a host-compat drift check added to kb.capabilities. The implementation and test were reading OpenClaw pluginApi compatibility from openclaw.plugin.json, but the current packaging contract keeps that metadata in package.json.

• Root cause

  • tests/test_capabilities.py expected openclaw.plugin.json["openclaw"]["compat"]["pluginApi"]
  • the manifest intentionally has no top-level openclaw field, so the check failed with KeyError and host_compat degraded to {}

• Capabilities metadata

  • add host_compat to the Capabilities model
  • populate kb.capabilities.host_compat from package.json via a small loader in src/vouch/capabilities.py
  • keep the loader defensive: missing or malformed package metadata returns {} rather than breaking capability reporting

• Regression coverage

  • update the capabilities tests to treat package.json as the source of truth for OpenClaw pluginApi
  • add focused fallback cases for missing and malformed package.json

def _load_host_compat() -> dict[str, dict[str, str]]:
    package_json = json.loads(_PACKAGE_JSON_PATH.read_text(encoding="utf-8"))
    compat = package_json.get("openclaw", {}).get("compat")
    if not isinstance(compat, dict):
        return {}
    return {"openclaw": {k: str(v) for k, v in compat.items()}}