Deny state-only plugins from invoking actions

[sebastientaggart]

ScopedActionRegistry.run() previously denied only read-only, which allowed state-only plugins to invoke arbitrary registered actions (including orchestrator commands like agent.start). This contradicted the docstring intent that state-only has no orchestrator access.

Tightens run() to require full capability, clarifies the state-only docstring bullet to say "cannot register or invoke actions", and extends the state-only test to pin the new behavior.

Closes #15

[sebastientaggart]

Review Summary

Verdict: APPROVE

Findings

No issues found. Code looks correct and follows project conventions. The run() guard now correctly denies any non-full capability (covering both read-only and state-only), the module docstring is updated to match, and a regression test asserts that state-only plugins cannot invoke actions.