feat(security): #501 — host-controlled per-package capability enforcement

[proggeramlug]

Closes #501.

Summary

The headline supply-chain hardening lever. Most npm packages will never declare capabilities themselves; control sits entirely in the host application's package.json. This adds a compile-time HIR pass that walks each imported dep's source modules, derives the capability tokens its stdlib calls would need, and refuses to compile any call site whose required token isn't in the per-package allow-list.

Zero runtime cost. Cross-platform — runs in the platform-agnostic compile_command driver before any backend (LLVM / WASM / ArkTS / HarmonyOS / Glance / SwiftUI / JS) is invoked.

Host config

{
  "perry": {
    "permissions": {
      "lodash": [],
      "axios": ["net:fetch"],
      "@scope/utils": ["crypto"],
      "*": []
    }
  }
}

Capability tokens (MVP)

fs:read, fs:write, crypto, proc:env, proc:argv, proc:exec, net:fetch, net:listen, net:connect, plus universal *.

Diagnostic

Combined error across every module (capped at 12 entries) names the owning package, the call, the source span, and the missing token.

Opt-in semantics

Empty perry.permissions → pass disabled (existing builds unchanged). Set the map to enable. Host's own code is always granted * unconditionally — gating host code is the --lockdown mode (#496), not per-package policy.

Test coverage

12 unit tests in perry-hir::capability::tests cover host pass-through, scope-aware package attribution, explicit deny / grant / wildcard, dep-specific override of * default, and the major per-capability families (fs:read, proc:exec, proc:env, net:fetch, crypto). All pass.

Standalone implementation

Doesn't depend on the in-flight #495 SBOM PR. The walker is in perry-hir::capability and uses the same shape as the other supply-chain HIR walkers (lockdown, egress). Walks both dedicated HIR variants and the general-shape NativeMethodCall fallback.

Notes

No Cargo.toml version bump, no CLAUDE.md touch, no CHANGELOG.md entry — maintainer folds those in at merge time.