Systema: add activation membrane and capability-radius mapping

[mdheller]

Objective

Implement Agent Machine's Systema role: runtime activation membrane and capability-radius mapping for local/clustered agent workloads.

Context

Agent Machine owns the machine-local runtime layer: hardware/runtime probing, provider lifecycle, model residency, cache-aware scheduling facts, AgentPod envelopes, governed side-effect boundaries, activation decisions, and execution receipts. Systema adds membrane accounting and capability radius semantics for those surfaces.

Required reading

• SocioProphet/ProCybernetica/docs/integration/SYSTEMA_PATTERN_INVENTORY_CONTROL.md
• SocioProphet/ProCybernetica/docs/patterns/MEMBRANE_BOUNDARIES.md
• SocioProphet/ProCybernetica/profiles/capability_radius_profile.yaml
• SocioProphet/ProCybernetica/profiles/membrane_boundary_profile.yaml

Deliverables

Add:

• docs/integration/systema-membrane-boundary.md
• docs/integration/systema-capability-radius.md
• examples/membranes/agent-machine-activation-membrane.example.json
• examples/reachability/agent-machine-capability-radius.example.json

Acceptance criteria

• Activation is documented as a membrane crossing.
• Activation examples declare admitted, blocked, transformed, logged, witnessed, and revoked behavior.
• Capability-radius examples align with R0-R5 semantics from ProCybernetica.
• No provider activation or runtime mutation is added in this tranche.

Validation

Run the existing validation gate:

make validate