feat: add compositor capability

programs/include/Api/Syscall.hpp

@@ -285,7 +285,14 @@ namespace montauk::abi {
        whatever that image is granted at its next launch. Formatting a data
        volume must not carry that authority with it. */
     static constexpr uint64_t CAP_SYSTEM_IMAGE   = 1ULL << 12;
-    static constexpr uint64_t CAP_ALL            = (1ULL << 13) - 1;
+    /* Map other processes' windows and deliver input events to them
+       (SYS_WINMAP, SYS_WINSENDEVENT): the desktop compositor's authority.
+       Anything holding it can read every window's pixels and click on any
+       window, including a consent prompt it is itself waiting on, so it is
+       never part of a session mask, never part of "all", and never
+       delegated by the compositor to what it launches. */
+    static constexpr uint64_t CAP_COMPOSITOR     = 1ULL << 13;
+    static constexpr uint64_t CAP_ALL            = (1ULL << 14) - 1;
     static constexpr uint64_t CAP_STANDARD_SESSION = CAP_POWER_REQUEST | CAP_SUSPEND;
     static constexpr uint64_t CAP_ADMIN_SESSION =
         CAP_STANDARD_SESSION | CAP_PROCESS_ADMIN | CAP_STORAGE_ADMIN |
@@ -297,6 +304,9 @@ namespace montauk::abi {
     static_assert((CAP_ADMIN_SESSION & CAP_SYSTEM_IMAGE) == 0,
                   "an admin session must not imply authority to rewrite the "
                   "programs it launches; grant CAP_SYSTEM_IMAGE per binary");
+    static_assert((CAP_ADMIN_SESSION & CAP_COMPOSITOR) == 0,
+                  "a session must not delegate the compositor's authority; "
+                  "login grants it to the desktop directly");
     static constexpr int SYS_ERR_PERMISSION = -13;
 
     struct SpawnCapabilities {