fix(acl): let the role an agent runs as reach the room oracle

[stormer78]

Second of two found while writing the data-rooms operator guide (#1273); the other is #1274.

The room presentation oracle exists for exactly one consumer — an agent holding strictly less than its human, asking its principal's VTA to mint a scoped presentation (rooms/keys/present) and to open what it cannot decrypt (rooms/keys/open). application is the role such an agent runs as; vta-agent-memory grants exactly it. It held neither RoomPresent nor RoomOpen, so the one consumer the oracle was built for could not call it.

There was no way around it per-entry either: the gates call role_has_capability, which reads the role and nothing else. The workaround an operator reaches for is worse than the grant — running the agent as initiator, which carries KeyMint and DeviceAdmin besides.

Why this is not a widening

RoomPresent	mints a leaf attenuated from the principal's own room authority — one action, one room, four hours, bound to the caller. The role already holds Sign: the principal's key over arbitrary bytes, and therefore strictly more
RoomOpen	decrypts a room record under a group key the VTA already holds. The same role can already read the credential vault

Reader and Monitor get neither, and a test pins it: minting a credential on a principal's behalf is not a read.

Two doc comments that described enforcement that does not exist

AclEntry::capabilities said the auth layer falls back to the role-derived set when it is empty — which reads as "and uses this set when it is not". It does not. No gate consults the field, the authenticated claims carry no capability set, and nothing over the wire can set it; it is read in exactly one place, to describe a registered device's authority in a binding listing. A reader who believed otherwise would think an entry was least-privileged when it holds everything its role does. The field and role_has_capability now say what is true.

Making it real — carrying the set in the claims, and giving the ACL surface a way to set it — is a separate change with its own design question: may an entry's capability set widen beyond its role, or only narrow within it? Worth doing, not worth smuggling in here.