feat: implement kernel capability model

programs/src/login/login_shutdown.cpp

@@ -250,10 +250,12 @@ void perform_graceful_shutdown(LoginState* ls, int action) {
 
     // ==== Stage 4: dispatch the ACPI power-off / reset ====
     show_stage(ls, heading, rebooting ? "Restarting now..." : "Powering off...");
-    if (rebooting) {
-        montauk::reset();
-    } else {
-        montauk::shutdown();
-    }
-    __builtin_unreachable();
+    int rc = rebooting ? montauk::reset() : montauk::shutdown();
+    // A successful power-control syscall never returns.  If it does return,
+    // keep the trusted supervisor alive and make the authorization failure
+    // visible instead of falling through an unreachable-code assumption.
+    show_stage(ls, heading, rc == montauk::abi::SYS_ERR_PERMISSION
+        ? "Power control permission denied."
+        : "Power control failed.");
+    for (;;) montauk::sleep_ms(1000);
 }