feat(capabilities): bind connections to trusted processes

[jdchawla29]

Summary

• add a generic Connection capability for process-scoped service access
• broker connections through a process guard instead of exposing credentials to the workspace
• use the nested Bubblewrap and seccomp notification boundary to authorize the launched process
• integrate guarded connections with workspace, SSH, Docker, Compose, and hosted runtime plumbing

Validation

• 740 focused agent, eval, environment, capability, client, and CLI tests passed; 1 skipped
• repository CI formatting check passed
• repository CI Ruff check passed
• repository CI full-extra type check passed

Stack

Layer 3 of 4.

Depends on #626.
Final layer: #628.

[jdchawla29]

Consolidated into #624, which now contains the complete runtime-agent SDK cut against main. Closing this intermediate stack PR without merging.