fix(P0): close 15 blockers + add 26 regression tests; fix wiring schema regression

Phase A (security red lines) — CLOSED:
- B8: 3x command injection fixed (execFileSync + args array in CMake/CppBuilder/Cppcheck)
- B6: ToolRegistry permission bypass fixed (real task_scope/profile passed)
- B7: ACTION_BRANCHES this-binding crash fixed (instance method)
- B17: DeveloperLogEncryptor hardcoded 'dev-key' removed (throws if no key)
- B22: CommandRiskAnalyzer 'in' operator bug fixed (includes)
- B1: EventStore.project() transaction handle now passed to all repos
- B2: workspace projection illegal enum fixed (active/merged)
- B4: route_prefix separator unified to '/'
- B5: TaskAttempt column mapping fixed

Other blockers fixed:
- B3: project-level DB schema aligned to db-schema §20 (.air/local, learned_memories)
- B9: cpp.* tools registered through PermissionEngine path
- B11: Scheduler BLOCKED/CANCELLED states added
- B18: CapabilityTrustLevel 5-level enum aligned
- B19: PermissionEngine block/refuse/announce_then_run + grant_scope
- B20: Worker exit code 4 = parent_cancelled
- B24: project_id now randomUUID

Regression fix (introduced by B3 schema refactor):
- wiring.ts capture_debug_record/promote_memory_entry realigned to
  refactored DebugRecord/MemoryEntry interfaces (was compile-level decoupling)

Tests: 128 regression/unit tests pass (22 regression + 3 unit + 3 e2e suites)

Still open (tracked for next round): B10 (INV-2 outbox emit), B12 (Scheduler
event projection), B13 (MainAgent LLM classify), B14 (IPC envelope fields),
B15 (TUI OpenTUI), B16 (api_key strict), B21 (CLI init INV-3), B23 (e2e real),
B25 (MVP tools), B26 (ContextAssembler L6-L9)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/llm/test/capability-matrix-fields.test.ts

@@ -0,0 +1,60 @@
+/**
+ * Regression test: CapabilityMatrix nested supports structure
+ *
+ * Verifies that ProviderCapability uses a nested `supports` object
+ * with all 17 fields, plus optional conversion, quality_tier, cost_tier.
+ */
+
+import { describe, test, expect } from 'bun:test'
+import { readFileSync } from 'fs'
+import { join } from 'path'
+
+const SOURCE_PATH = join(
+  import.meta.dir,
+  '..',
+  'src',
+  'CapabilityMatrix.ts'
+)
+
+const source = readFileSync(SOURCE_PATH, 'utf-8')
+
+describe('CapabilityMatrix nested supports structure', () => {
+  test('ProviderCapability has nested supports object', () => {
+    // The interface should declare a `supports: SupportsMap` field
+    expect(source).toContain('supports: SupportsMap')
+    // The SupportsMap interface should exist
+    expect(source).toContain('export interface SupportsMap')
+  })
+
+  test('supports object includes 17 fields', () => {
+    // Extract SupportsMap interface body
+    const match = source.match(/export interface SupportsMap\s*\{([^}]+)\}/s)
+    expect(match).not.toBeNull()
+
+    const body = match![1]
+    // Count field declarations (lines with a colon)
+    const fields = body
+      .split('\n')
+      .map(line => line.trim())
+      .filter(line => line.includes(':') && !line.startsWith('//'))
+
+    expect(fields.length).toBe(17)
+  })
+
+  test('supports includes thinking, streaming, tool_use, prompt_cache', () => {
+    expect(source).toContain('thinking: boolean')
+    expect(source).toContain('streaming: boolean')
+    expect(source).toContain('tool_use: boolean')
+    expect(source).toContain('prompt_cache: boolean')
+  })
+
+  test('ProviderCapability has quality_tier and cost_tier', () => {
+    expect(source).toContain('quality_tier')
+    expect(source).toContain('cost_tier')
+  })
+
+  test('supports() method queries nested supports', () => {
+    // The supports() method should access caps.supports[capability]
+    expect(source).toContain('caps.supports[capability]')
+  })
+})