feat(nyxid-chat): project authoritative NyxID readiness capability identity on tool steps

[eanz17]

Context

nyxid-chat recovery UI must route connection/grant failures back to the
matching NyxID readiness capability.

The current contract cannot do this safely:

• NyxIdChatToolStepSource defines tool_name, service_slug, and
  service_id, but production task creation populates only tool_name.
• live task frames may carry the actor step protobuf, while the public
  current-state projector/DTO drops source entirely.
• connected service ID, service slug, catalog slug, and NyxID readiness
  capabilityId are different identity domains. Consumers must not infer
  equality between them.

Related consumer: eanz17/nyxid-chat#10.
Related readiness producer: ChronoAIProject/NyxID#1307.

Scope

• Add an optional producer-authored readiness_capability_id
  (readinessCapabilityId on JSON) to typed NyxID tool provenance.
• Snapshot that exact identity into the actor-owned tool step source when
  the authorized tool call is admitted.
• Preserve it unchanged in nyxid.task.snapshot,
  nyxid.task.step.changed, and
  GET /api/chat/conversations/{conversationId}/state.
• Keep connected service ID, service slug, and catalog slug as separate
  identities with their existing meanings.
• Check in convergent live-frame and current-state fixtures for failed
  and uncertain tool steps.

When authoritative provenance is unavailable, omit the field. Do not
derive it from tool names, failure text, service IDs, or slugs.

Acceptance

• Live and current-state expose the same readinessCapabilityId.
• Reload/passivation preserves the identity unchanged.
• A test keeps connected service ID, service slug, catalog slug, and
  readiness capability ID intentionally distinct.
• Missing authoritative identity produces no fabricated recovery hint.
• Existing externalEffect and actor-computed availableActions
  remain unchanged.
• Fixtures contain no credentials, URLs, raw tool arguments, or results.

Non-scope

No readiness fetch inside Aevatar, no management URL projection, no
browser heuristics, no frontend implementation, and no new recovery
authority outside the conversation actor.

[eanz17]

Production follow-up verification from the nyxid-chat consumer:

• The configured mainnet OpenAPI contains neither readinessCapabilityId nor readiness_capability_id.
• Current-state GET responses have no published response schema, so the consumer cannot prove a capability identity from OpenAPI.
• Mainnet health/status is ready, but no health/root response exposes a build or commit SHA.
• Repository issue/PR search does not currently identify the implementation commit for this issue.

The browser must not equate tool serviceId/slug with a NyxID readiness capabilityId. Please link the implementation commit plus deployed build identity and a convergent live/current-state fixture or production canary. eanz17/nyxid-chat#10 remains blocked on that evidence.