a plugin declares permissions, not capabilities, and has no kind

'capabilities' already means three things in this codebase — the permission
registry, the officer-items store, and the sidecar's routing keys. a fourth
would be one too many, and the field is really just permissions. the name is
free: the old permissions table went in 044aacf4.

and the kind enum is gone with it. the first draft handed a plugin the
platform's own five-value CapabilityKind and then forbade three of them. those
five exist because the platform has five sorts of surface; a plugin has two —
grantable to members, or owner-only. a boolean says it, and says it without
needing a prohibition: a plugin cannot claim core if core is not a word it can
say.

offscale is ownerOnly: true, which is what kind: 'admin' meant.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/offscale-plugin.md

@@ -491,13 +491,16 @@ export const manifest = {
     script: 'sidecar/index.ts',
   },
 
-  /** Permissions this plugin defines. `app` or `admin` only — see below. */
+  // Named `permissions`, NOT `capabilities`. That word already means three different things here — the
-  capabilities: [
+  // permission registry, the officer-items store, and the sidecar's routing keys — and a fourth would be
+  // one too many. `permissions` is accurate and free: the old table of that name went in 044aacf4.
+  permissions: [
     {
       key: 'offscale',
       label: 'Offscale',
       description: 'The tailnet: machines, routes and ACLs',
-      kind: 'admin',
+      /** Owner-only, or grantable to members. The whole distinction a plugin needs. */
+      ownerOnly: true,
     },
   ],