feat: implement kernel capability model

programs/include/gui/terminal.hpp

@@ -10,6 +10,7 @@
 #include <montauk/syscall.h>
 #include <montauk/string.h>
 #include <Api/Syscall.hpp>
+#include <montauk/capabilities.h>
 
 namespace gui {
 
@@ -212,7 +213,19 @@ static inline void terminal_init(TerminalState* t, int cols, int rows) {
     terminal_init_cells(t, cols, rows, TERM_MAX_SCROLLBACK);
     t->cursor_visible = true;
 
-    t->child_pid = montauk::spawn_redir("0:/os/shell.elf");
+    // A console shell is a session launcher, exactly like the desktop, and is
+    // granted on exactly the same terms: 0:/config/capabilities.toml decides
+    // what shell.elf receives, and the kernel clamps that to what this session
+    // was actually delegated.  Deriving the grant here instead would be a
+    // second, hardcoded list of "capabilities a console may confer" -- one the
+    // table cannot see and cannot keep in step with.
+    static constexpr const char* kShellPath = "0:/os/shell.elf";
+    montauk::abi::SpawnCapabilities caps =
+        montauk::caps::for_binary(kShellPath, montauk::caps::self_delegable());
+
+    t->child_pid = (caps.permitted != 0)
+        ? montauk::spawn_redir_with_caps(kShellPath, nullptr, caps)
+        : montauk::spawn_redir(kShellPath);
     if (t->child_pid > 0)
         montauk::childio_settermsz(t->child_pid, cols, rows);
 }