Function build_capability_probe_script 

pub fn build_capability_probe_script(spec: &ProbeSpec) -> String

Build the capability-probe shell script. It is intentionally fail-soft: every probe that errors simply omits its fact line, so a missing rustup or a broken binary shows up as absent facts (capability), never as a script crash (reachability).