feat: Phase 2 - kernel capability bitmask (uid==0 -> has_cap())

Replace all 9 kernel uid==0 privilege checks with a capability bitmask
model. Adds caps:u64 field to Context and CallerCtx, with CAP_ALL for
root processes. Zero behavioral change - uid==0 still gets all caps.

New module: src/scheme/caps.rs with 10 capability constants.
9 check sites converted: acpi, irq, memory, debug, serio, sys (msr+write),
scheme registration, and fchown.

Patch: local/patches/kernel/P27-capability-bitmask.patch

recipes/core/kernel/source/src/startup/mod.rs

@@ -188,6 +188,7 @@ pub(crate) fn kmain(bootstrap: Bootstrap) -> ! {
             // TODO: Remove these from kernel
             context.euid = 0;
             context.egid = 0;
+            context.caps = crate::scheme::caps::CAP_ALL;
         }
         Err(_err) => halt_boot("FATAL: failed to spawn first userspace process userspace_init\n"),
     }