Function capability_request_requires_dpop_with_model_metadata 

pub fn capability_request_requires_dpop_with_model_metadata(
    cap: &CapabilityToken,
    tool_name: &str,
    server_id: &str,
    arguments: &Value,
    model_metadata: Option<&ModelMetadata>,
) -> Result<bool, KernelError>

Return whether any grant matching this model-aware tool request requires DPoP.

This uses the same private grant resolver as the kernel dispatch path, so callers do not need to duplicate wildcard, operation, and constraint matching semantics.