fix(capsule): make component→root capability merge exhaustive (#1232)

[jvsteiner]

Linked Issue

Closes #1232.

Summary

discovery.rs folded each [[component]].capabilities into the root manifest field-by-field by hand-enumeration, so any field not explicitly listed was silently dropped — the security gate reads only the root, so a component-only declaration granted nothing, with no error. Dropped fields: net_connect, uplink, kv, identity, allow_persistent, allow_prompt_injection. Concretely, a capsule declaring net_connect at component level couldn't open the connections it asked for.

Changes

• Add exhaustive CapabilitiesDef::merge_from(&mut self, other) (allowlists concatenated, flags OR-ed). It destructures the source struct with no .. rest pattern, so adding a field to CapabilitiesDef fails to compile there until it's handled — this class of silent-drop can't recur.
• discovery.rs now calls manifest.capabilities.merge_from(caps) instead of the enumerated merge.

Verification

• cargo test -p astrid-capsule-types -p astrid-capsule green.
• merge_from_unions_every_field (fully-populated structs; every field unions) and component_level_capabilities_merge_into_root (the discovery-seam regression: a component-only net_connect surfaces in the root).
• clippy clean, rustfmt applied.

Checklist

• Linked to an issue
• CHANGELOG.md updated

[jvsteiner]

@joshuajbouw ready for review — exhaustive CapabilitiesDef::merge_from so component-level caps (net_connect etc.) stop getting silently dropped (#1232).

[joshuajbouw]

Review outcome: technically worth advancing. The exhaustive capability merge and regression coverage look correct, and the substantive CI jobs are green. Please fix the required PR-template sections and add the changelog entry so the repository checks can pass.