feat: unify system status codes

programs/include/Api/Syscall.hpp

@@ -7,6 +7,7 @@
 #pragma once
 #include <cstdint>
 #include <cstddef>
+#include <montauk/statuscodes.h>
 
 namespace montauk::abi {
 
@@ -312,6 +313,9 @@ namespace montauk::abi {
     static_assert((CAP_ADMIN_SESSION & CAP_COMPOSITOR) == 0,
                   "a session must not delegate the compositor's authority; "
                   "login grants it to the desktop directly");
+    // Capability denial for the Wi-Fi and USB syscalls only, which keep their
+    // own WIFI_ERR_* / USB_ERR_* spaces; everything else returns
+    // CapabilityDenied from StatusCodes.
     static constexpr int SYS_ERR_PERMISSION = -13;
 
     // A process holds two independent sets: what it may use (effective) and