Summary

• Add core placement requirement capability DTOs and provider capability report status constants.
• Add ValidatePlacementRequirementsAgainstCapabilities for capability tags, executor provider/tier/proof support, provider report status, and explicit executor matching.
• Add ExecutorCapabilitiesHaveSupportedMatch for shared executor matching with provider report awareness.

Verification

• RED: GOWORK=off go test ./protocol -run TestValidatePlacementRequirementsAgainstCapabilities -count=1 failed before implementation with missing API symbols.
• GOWORK=off go test ./protocol -run TestValidatePlacementRequirementsAgainstCapabilities -count=1
• git diff --check
• GOWORK=off go test ./... -count=1

Adversarial Review

• Hardware class and attestation matching remains in workflow-compute for now because it depends on richer host hardware state.
• Generic placement requirement matching is now core-owned so plugins can share the same capability semantics.
• Existing error strings are preserved to avoid scheduler/admission behavior drift.