feat: implement kernel capability model

programs/man/shell.1

@@ -129,8 +129,14 @@
     fontscale [n]       Get or set terminal font scale -- see fontscale(1)
     lua                 Lua interpreter
     tcc                 TinyCC (in-system C compiler)
-    reset               Reboot the system
-    shutdown            Shut down the system
+    reset / reboot      Request a supervised system reboot
+    shutdown / poweroff Request a supervised system shutdown
+    suspend             Enter ACPI sleep
+
+    Interactive shutdown and reboot are shell builtins: they post a
+    capability-checked request and exit the console, allowing login.elf to
+    flush filesystems and perform the final power operation. They do not grant
+    CAP_POWER_CONTROL to the shell.
 
 .SS Network commands
     ping <host>         Send ICMP echo requests -- see ping(1)