feat: implement kernel capability model

programs/src/init/main.cpp

@@ -7,6 +7,7 @@
 
 #include <montauk/syscall.h>
 #include <montauk/config.h>
+#include <montauk/capabilities.h>
 #include <libc/stdio.h>
 
 // ---- ANSI color codes ----
@@ -80,7 +81,11 @@ static bool run_service(const char* path, const char* name, bool wait = true) {
     snprintf(msg, sizeof(msg), "Starting %s", name);
     log_info(msg);
 
-    int pid = montauk::spawn(path);
+    // Grants are keyed on the executable, not the service id, so repointing a
+    // privileged entry in init.toml at another program transfers no authority.
+    montauk::abi::SpawnCapabilities caps =
+        montauk::caps::for_binary(path, montauk::caps::self_delegable());
+    int pid = montauk::spawn_with_caps(path, nullptr, "system", caps);
     if (pid < 0) {
         snprintf(msg, sizeof(msg), "Failed to start %s", name);
         log_err(msg);