feat: implement kernel capability model

kernel/src/Sched/Scheduler.hpp

@@ -86,6 +86,9 @@ namespace Sched {
         char environment[EnvironmentBytes]; // NUL-separated NAME=VALUE entries
         uint32_t environmentLength;
         char user[32];            // Owner user name (inherited from parent on spawn)
+        uint64_t permittedCaps;   // Authority owned by this process
+        uint64_t effectiveCaps;   // Authority currently usable by syscalls
+        uint64_t delegableCaps;   // Authority this process may pass to children
         int sessionId;            // Process-session leader PID (inherited on spawn)
         char cwd[256];            // Absolute current working directory
 
@@ -144,7 +147,9 @@ namespace Sched {
 
     void Initialize();
     int Spawn(const char* vfsPath, const char* args = nullptr, bool startReady = true,
-              const char* environment = nullptr, uint32_t environmentLength = 0);
+              const char* environment = nullptr, uint32_t environmentLength = 0,
+              const montauk::abi::SpawnCapabilities* capabilities = nullptr,
+              const char* userOverride = nullptr);
     int StartProcess(int pid);
     void Schedule();
 
@@ -172,6 +177,10 @@ namespace Sched {
     // Always returns the slot that owns per-process state -- never a sibling thread.
     Process* GetCurrentProcessPtr();
 
+    // Capability checks always consult kernel-owned process metadata. User
+    // names are deliberately excluded from authorization.
+    bool HasCapability(uint64_t capability);
+
     // Get a pointer to the currently running thread's slot (may be a sibling).
     Process* GetCurrentThreadPtr();