refactor: capabilities - add unified launch routine

programs/src/shell/exec.cpp

@@ -41,17 +41,8 @@ static void print_exit_code(int code) {
 
 static bool try_exec(const char* path, const char* args) {
     if (!file_exists(path)) return false;
-    // Least-privilege hygiene, NOT a security boundary: this never decides
-    // what may run, only which capabilities a tool receives.  The user in an
-    // admin console can already do everything these tools do, so the point is
-    // to keep a bug in one tool from reaching authority it has no use for.
-    // The shell delegates on the same terms as the desktop; the table decides
-    // per binary, and the kernel re-checks the bound on every spawn.
-    montauk::abi::SpawnCapabilities caps =
-        montauk::caps::for_binary(path, shell_delegable_caps);
-    int pid = (caps.permitted != 0)
-        ? montauk::spawn_with_caps(path, args, nullptr, caps)
-        : montauk::spawn(path, args);
+    
+    int pid = montauk::caps::launch(path, {.args = args});
     if (pid < 0) return false;
     print_exit_code(montauk::waitpid(pid));
     return true;

programs/src/shell/main.cpp

@@ -13,7 +13,6 @@ int current_drive = 0;
 int last_exit = 0;
 char session_user[32] = "";
 char session_home[64] = "";
-uint64_t shell_delegable_caps = 0;
 
 void sync_cwd() {
     char abs[128];
@@ -47,8 +46,6 @@ void read_session() {
 
     scopy(session_home, "0:/users/", sizeof(session_home));
     scat(session_home, session_user, sizeof(session_home));
-
-    shell_delegable_caps = montauk::caps::self_delegable();
 }
 
 // ---- Command history ----

programs/src/shell/shell.h

@@ -56,7 +56,6 @@ extern int current_drive;
 extern int last_exit;
 extern char session_user[32];
 extern char session_home[64];
-extern uint64_t shell_delegable_caps;
 
 // ---- Inline path helpers ----