Function bundle_capability_ceiling 

pub fn bundle_capability_ceiling(bundle: &WorkflowBundle) -> CapabilityPolicy

Project a bundle’s effective capability ceiling. The bundle does not carry a single capability policy; we compose one from the per-node capability_policy declarations, the bundle-level tool_policy keys, the connector scopes, the autonomy tier, the worktree_policy, and the declared command_gates. The result is what a parent runtime needs to compare against to decide whether running this bundle would widen its own ceiling.