Function matches 

pub fn matches(required: &CapabilityRequirement, worker: &CapabilitySet) -> bool

Subset predicate: every required token appears in the worker’s set.

Case-sensitive, exact-string match. Empty required → true. This is the pure-Rust mirror of Lua missing_capabilities in lua/scheduling.lua.

Called from:

• ff-scheduler::claim (fast-path short-circuit before quota admission)
• ff-backend-postgres (future; direct predicate in admission path)