Function warn_unless_capable 

pub fn warn_unless_capable(root: &Path, required: Capability) -> bool

Check whether the current user has a management capability. Prints a warning to stderr if denied or not registered. Blocks AI members from manage-level actions entirely. Returns true if allowed, false if denied.