feat: add permission consent prompts, drop permitted capability mask

kernel/src/Fs/ProtectedPaths.hpp

@@ -13,6 +13,11 @@ namespace Fs {
     // re-timestamp `path`. Returns 0 when the path is unprotected.
     uint64_t RequiredFileWriteCapability(const char* path);
 
+    // True for an installed program image: one on the system volume that
+    // cannot be replaced without CAP_SYSTEM_IMAGE (0:/os, 0:/apps). Only such
+    // an image is identified by its path well enough to carry a grant.
+    bool IsSystemImage(const char* path);
+
     // Log the rule table at boot, so a path that should be protected and is
     // not is visible rather than silently missing.
     void LogProtectedPaths();