fix: harden runtime profile selection

[steipete-oai]

Summary

• enforce the configured profile allowlist through both managed and standalone provisioning
• preserve configured capability withdrawals when an adapter omits or partially reports capabilities
• reject malformed capability maps and show effective target/capability details in the selector
• document the SSH profile override and update regression coverage

Why

Follow-up review of #31 found policy and capability mismatches at alternate provisioning boundaries. This keeps the profile catalog authoritative and makes the UI match the backend defaults.

Verification

• 73 focused Node tests covering runtime adapters, profile parsing, UI helpers, and dialogs
• full Go test suite
• pinned oxfmt and oxlint clean
• Deno type-check for the standalone profile parser
• structured autoreview clean

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix: harden runtime profile selection This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.