Extend --fix descriptor refresh to memory and feed subscription failures

[mostlydev]

Summary

Follow-up to #224 / PR #225. The validation-driven descriptor-refresh path that #224 added only fires for resolveToolSubscriptions failures. Memory and feed subscriptions have the same chicken-and-egg shape but their resolution errors are plain fmt.Errorf strings, so the runtimeDescriptorRefreshCandidate helper never identifies them as candidates for claw up --fix -d auto-refresh.

Symptom

Operator updates a build-backed provider service to expose a new memory or feed capability, allowlists it on a consumer, and runs claw up -d:

• For tools (already covered by Make descriptor refresh automatic during claw up --fix #224): service "X": tool policy for "Y" references unknown tool "Z" → wrapped with run: claw up --fix -d hint, and --fix mode auto-refreshes the descriptor.
• For memory (still missing): service "X": memory target "Y" does not declare a memory capability → no remediation hint, no auto-refresh under --fix.
• For feeds (still missing): service "X": feed "Y" was not found in the descriptor registry → no remediation hint, no auto-refresh under --fix.

Desired Behavior

Same UX as the tool path:

• claw up -d (strict) failure for memory/feeds on a build-backed provider should wrap with run: claw up --fix -d.
• claw up --fix -d should rebuild the provider, refresh its descriptor snapshot, and retry capability resolution.

No new operator-facing flags. Same internal helper (resolvePodCapabilities retry loop).

Implementation Sketch

1. Introduce typed errors for resolveMemorySubscriptions and resolveFeedSubscriptions (mirror of toolResolutionError introduced in Refresh runtime descriptors during claw up --fix #225).
2. Extend runtimeDescriptorRefreshCandidate to also recognize the new typed errors and identify the build-backed provider service that needs refreshing.
3. The existing refreshRuntimeDescriptor + retry loop should require no changes — once the candidate detection covers all three error types, the recovery path is shared.
4. Tests:
   • Strict-mode hint coverage for memory + feed errors with build-backed providers.
   • --fix retry coverage for memory + feed unknown-capability errors that get fixed by snapshot refresh.

Code Pointers

• cmd/claw/compose_up.go — resolveToolSubscriptions returns *toolResolutionError; resolveMemorySubscriptions and resolveFeedSubscriptions still return plain errors.
• cmd/claw/compose_up.go — runtimeDescriptorRefreshCandidate extracts the typed error.
• cmd/claw/compose_up.go — resolvePodCapabilities is the retry loop entry point.
• PR Refresh runtime descriptors during claw up --fix #225 — original tool-path implementation to mirror.

Acceptance Criteria

• A pod that adds a runtime-emitted memory or feed capability and subscribes to it in the same update is remediated by claw up --fix -d.
• Plain claw up -d for the same scenario errors with a direct claw up --fix -d hint.
• Tests cover strict-mode hint and --fix retry for both memory and feed paths.