Function required_capability 

pub fn required_capability(
    req: &KernelRequest,
    scope: AuthorityScope,
) -> &'static str

Return the static capability string required to satisfy req under scope.

Pure function so the capability mapping can be unit-tested in isolation. Every KernelRequest variant is covered; there is no default-allow branch.