Function map_requirement 

pub fn map_requirement(req: Requirement) -> CapabilityDecision

Map a parsed requirement to oxicode’s policy. The decision is read-only — it does not mutate state. The caller is responsible for translating Allow into the right port wiring.