feat(execution)!: add fixed compute stdlib

[jmgilman]

Summary

• add an always-on fixed worker language surface with numeric sum(iterable), json.decode / json.encode / json.indent, and the complete pinned math module
• reject capability namespace roots that collide with standard Starlark universe names or the fixed stdlib at catalog, execution, and worker-manifest boundaries
• document the exact language surface, assert the reference against the runtime name lists, and prove all additions through a real same-binary MCP execution

Breaking change

Capability names whose first dotted segment is a standard Starlark universe name, sum, json, or math now fail Build with ErrInvalidRegistration. Nested uses such as stats.sum remain legal. This prevents registered capability namespaces from shadowing the fixed language contract.

Validation

• mise exec -- go test ./internal/universe ./internal/execution ./internal/catalog ./internal/worker ./mcpserver -count=1
• mise exec -- moon run root:check --force
• persistent integrated code review: approved with no remaining findings

Follow-up

#45 tracks recursive depth amplification inside upstream JSON encode/decode. The current worker-process boundary contains a resulting runtime abort to one execution; a complete fix needs to cover both directions and define a separate internal-compute depth contract.

Closes #42

BREAKING CHANGE: Capability names whose top-level segment is a standard Starlark universe name, sum, json, or math now fail Build with ErrInvalidRegistration.