feat: share resource capacity validation

[intel352]

Summary

• Add a core ResourceCapacity DTO for worker CPU/memory/disk capacity.
• Add ValidateResourceLimitsAgainstCapacity to centralize CPU, memory, and workspace limit checks.

Verification

• RED: GOWORK=off go test ./protocol -run TestValidateResourceLimitsAgainstCapacity -count=1 failed before implementation with missing API symbols.
• GOWORK=off go test ./protocol -run TestValidateResourceLimitsAgainstCapacity -count=1
• git diff --check
• GOWORK=off go test ./... -count=1

Adversarial Review

• Preserves the existing behavior that unknown capacity values do not reject limits.
• Keeps workflow-compute-specific Capabilities out of compute-core; callers adapt into ResourceCapacity.
• Centralizes arithmetic and error strings without changing scheduler policy.