step 4/4: the docs say permissions too, and capability means one thing again

44 files of prose — CLAUDE.md, AGENTS.md, TODO.md, 20 docs, both plugin design
documents, and the comment surface the earlier steps could not reach.

Applied against an explicit keep-list, not swept, because the word turned out to
have SIX meanings in this repository rather than the three the offscale doc
recorded:

  permissions          renamed (steps 1–2)
  $OFFICER_ROOT/capabilities/  KEPT — the item store, and now the only thing
                               the word means that is ours
  sidecar routing keys renamed to `handles` (step 3)
  Lightning wallet     KEPT — a domain term, and on the wire to the mobile apps
  terminfo queries     KEPT — XTGETTCAP, in the pty sidecar
  InvoiceShelf         KEPT — per-resource { write, bulkDelete } flags

The sweep still falsified two things, both caught by checking rather than by
review, and both in prose that discusses more than one meaning at once:

CLAUDE.md began claiming the item store lives at `$OFFICER_ROOT/permissions`.
It does not; that directory is on disk and full of skills and tools.

And the offscale doc's own note about the collision became
"Named `permissions`, NOT `permissions`" — a sentence that had eaten the thing
it existed to warn about.

Both restored, and the note rewritten to say what is now true: capability means
one thing of ours, and three that belong to somebody else's vocabulary.

Verified live after restart: self and admin permission endpoints 200, gated
route 200, agent-status 200, 9 grants intact with 6 permissions offered.
tsgo clean, 797 tests, 787 pass, same 7.

The rename is done. Four steps, no data lost, no client break that survived
the step it was introduced in.

docs/agent-git-identity.md

@@ -9,7 +9,7 @@ A team of agents works on this project, sometimes several of them in the same re
 one should commit under its own identity, so `git log` answers "which agent wrote this" without anybody
 having to remember to say so.
 
-Today it cannot. Every agent commits as the owner, because every agent *is* the owner as far as the OS
+Today it cannot. Every agent commits as the owner, because every agent _is_ the owner as far as the OS
 is concerned.
 
 ## How git identity can be overridden at all
@@ -85,7 +85,7 @@ const { CLAUDECODE: _c, CLAUDE_CODE_ENTRYPOINT: _e, CLAUDE_CODE_SSE_PORT: _s, ..
 That is the whole story: the child gets the sidecar's full `process.env` minus the three nested-session
 guards, and nothing is added per turn.
 
-**This is the good news.** `env` is *already* a per-`query()` option. It is built once today, but there
+**This is the good news.** `env` is _already_ a per-`query()` option. It is built once today, but there
 is no structural reason it has to be — which makes `claude-manager.ts:315` the single injection point
 for everything below.
 
@@ -96,8 +96,8 @@ Almost none, and none of it at the OS level.
 - `sessionKey` — officer's uuid, the key in the `sessions` map. Reaches the child only as a transport
   field on the pushed message.
 - **Agent name and persona are prompt-only.** `buildAgentPrompt`
-  (`src/servers/api/agents/agent-runner.ts:71-79`) inlines the agent's `AGENT.md` into the *first user
-  message*. There is no `systemPrompt`, no `--agents`, no per-agent settings file.
+  (`src/servers/api/agents/agent-runner.ts:71-79`) inlines the agent's `AGENT.md` into the _first user
+  message_. There is no `systemPrompt`, no `--agents`, no per-agent settings file.
 - The one durable per-agent handle is the working directory: `getAgentRunsDir(agent.dirName)`
   (`agent-runner.ts:144`), deliberately shared across all runs of that agent so the CLI groups their
   transcripts.
@@ -147,7 +147,7 @@ API field. Neither is a small change, and this document does not propose one.
 
 There is **no filesystem isolation** between agents. They share one real `HOME`
 (`HOME_DIR=/home/pastilhas`), one `~/.claude`, one credential store; `user-instance.ts:75-78` says this
-outright, and it is the stated reason `chat` is an `execution` capability that can never be granted.
+outright, and it is the stated reason `chat` is an `execution` permission that can never be granted.
 `grep -ril worktree src/` returns nothing — worktrees are used nowhere.
 
 cwd is the only per-session variation and it is not a boundary, since absolute paths escape it freely.