Slice: Specify UCAN capability delegation for profile operations

[flyingrobots]

Slice

Specify the capability model needed before Continuum participants can use UCAN-style authorization.

Source detail:

• authorization proves what an actor may do, not who they globally are;
• capabilities may include observe, export, import, debug, read, admit, reveal, promote, or mount operations depending on profile;
• delegation chains are signed and can be presented without making global identity public.

Done when:

• resource naming covers lane, observer coordinate, retained evidence, suffix, admission/reveal target, and profile operation targets;
• abilities are explicitly scoped;
• issuer, audience, resource, ability, expiry/revocation posture, and signature/proof refs are named;
• unsupported/credential-required posture is available to participants and tools.

Parent: #58.