Let a discovered candidate be adjusted without restating it

[bsbodden]

Why

CatalogDiscovery's javadoc states its purpose: it exists "so that using the router does not begin with writing out every model's price, latency and per-task quality by hand — figures a caller has no way to know and would have to invent." It delivers on that only if a caller can then change one thing about what it returned.

ModelCandidate is a record of thirteen components with no derivation. Adding a single capability to a discovered candidate meant rebuilding it component by component and keeping that copy in step by hand — which costs more than declaring the model from scratch. So not discovering was the rational choice, and the invented figures drifted from the artifacts: the deep-dive walkthrough declared qwen3-0.6b with a 32,768-token context window where its GGUF says 40,960, having never asked.

Probed against the released 0.1.60 catalog, discovery already returns for SmolLM2:

smollm2_360m_instruct_q8_0
  local=true capabilities=[chat] contextWindow=8192
  ttft=72ms tok/s=20.70 quality={}

Of the seven builder calls that walkthrough wrote for that model, four were already there, one was half there, and only per-task quality genuinely was not.

What

• ModelCandidate.toBuilder() — a builder initialised from every component.
• ModelCandidate.Builder.addCapabilities(String...) — adds rather than replaces, which is the operation a discovered candidate needs: the catalog reports what the model is (chat), an application routes on names only it defines (liveness, grounding).

Both additive and non-breaking.

Capabilities carry over from toBuilder as an explicit choice: on a fresh builder tags() seeds capabilities, and on a derived one that would silently discard what the application just added.

Evidence

• 7 new tests in CandidateDerivationTest, each checked against a deliberately broken implementation.
• One fixture was changed after a weak mutant: it held contextWindow at 8192, which is also the builder's default, so dropping that copy could not fail it. It now uses a real 131,072 and two tests catch the mutant.
• build complianceCheck verifyDependencyPolicy verifyReleaseMetadata: 2,721 tests, 0 failures, 0 errors. :docs:generateSite is excluded — it fails in any git worktree, independent of this change.