Capability-based tool permissioning for on-device LLM agents on iOS

A typed tool registry says what an agent can call, not whether the caller may call it now. The capability-handle pattern that closes the authorization gap.