feat(ai): dispatch federated capability broker

[first-assist]

Summary

• add canonical multi-subgraph capability index sets with global collision rejection and exact owner identity
• dispatch fixed-broker and deferred capability discovery through the durable application-tool boundary
• preserve current-principal, policy, schema, catalogue, capability, disclosure, egress, budget, resolver, and fencing checks
• add durable discover/describe/execute outcomes and client-deferred exact-definition installation

Migration

No database, data, SDL, protected-payload, backup, or restore migration. graphql-orm-ai is 0.85.0, graphql-orm-ai-tool-profiles is 0.8.0, and AI schema module remains 0.63.0. Hosts must rebuild capability indexes and clean up retained provider sessions whose capability binding changes before rebind.

Verification

• default and combined provider suites
• all seven isolated provider lanes
• durable fixed-broker discover/describe/execute SQLite E2E
• affected warnings-denied Clippy and strict Rustdoc
• PascalCase GraphQL contracts
• PostgreSQL and MSSQL Codex lanes
• disposable PostgreSQL parity
• release policy, deterministic manifest, SemVer, docs, inventory, formatting and diff checks

Documentation

• Documentation updated
• No documentation impact