pub const CAPABILITY_ALLOWLIST: &[&str];
Allow-listed capability tokens a node may advertise (WEFT-147).
Free-form strings outside this list are rejected at verification.