sync: port the capabilities rename and five modules' drift from constructive-db

[pyramation]

Summary

constructive-db vendors these modules under pgpm-modules/ and edits them in place, so the trees drift until someone ports back (last done in #118). This is that port, driven by the platform rename of permissions → capabilities.

I diffed all 30 vendored modules against packages/. Only five have substantive drift; the other 25 differ solely in the test harness import (constructive-test vs pgsql-test) and in bundle artifacts, so they are untouched here.

metaschema-modules — the rename, and it is a rename in place, not an append-only change:

deploy|revert|verify/schemas/metaschema_modules_public/tables/
  permissions_module/      -> capabilities_module/
  data_permissions_field/  -> data_capabilities_field/
every module table with it:
  default_permissions text[]  -> default_capabilities text[]
+ content_preset_module/  email_sender_module/  oauth_requests_module/  file_ref_field/

The four added tables are modules provision_database_modules already accepts; they were only missing here.

function-resolution — the opt-in staging bucket: resolve_staging_bucket + staging_bucket_tag changes and the corresponding resolve_api update.

metaschema-schema / object-store / object-tree — procedure-level fixes (enforce_api_exposure_ratchet, object_category, insert_nodes_at_paths, init_empty_repo, set_and_commit, set_many_and_commit).

Notes for review:

• Tests were copied from the vendored tree but rewritten back to import { ... } from 'pgsql-test' — the vendored constructive-test import is not upstreamed.
• sql/*.sql and sql/*.bundle.tar.gz regenerated with pgpm package on 5.23.1 (5.8.0 resolves inside the workspace and silently emits no bundle — it deletes the artifact).
• metaschema-modules snapshots re-recorded against the ported deploy tree (68 → 71 module tables, 486 → 505 FK constraints). The vendored snapshot was itself stale, so it was not copied verbatim.
• A release bump is needed before publishing. 0.40.0 is already released and this changes object names inside it.

Verified locally against constructiveio/postgres-plus:18: function-resolution 83/83, object-store 28/28, object-tree 15/15, metaschema-schema 1/1, metaschema-modules 8/8.

Not ported, flagging instead: constructive-db also vendors two modules that do not exist here at all — @pgpm/db-utils and @pgpm/infra-utils, both 0.0.1. They look deliberately platform-local; say the word if they belong upstream.

Link to Devin session: https://app.devin.ai/sessions/8f89acc9280e4cef880921d966e0e8fc
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring