refactor: add one-shot feed capability broker

[chhoumann]

Summary

• add a factory-only broker that converts validated feed capability records into one-shot, purpose-scoped network leases
• keep the raw target resolver, capability issuer, and transport lifecycle behind frozen null-prototype facades
• cancel pending repository reads, active transport work, and non-cooperative callbacks when a feed, episode, or runtime is invalidated
• map each feed and episode resource kind to its exact target and matching private-network grant while leaving episode streams unbuffered

Security and lifecycle properties

• capabilities are revoked after success, failure, invalidation, or aggregate disposal
• invalidation starts before repository reads, preventing stale records from issuing authority after a target or grant changes
• revoked transport failures and late callback results are suppressed as unavailable
• callers cannot recover a broker constructor, issuer, resolver, or component-level dispose path

Validation

• npm run lint
• npm run format:check
• npm run typecheck
• npm run build
• npm run test - 89 files and 1,482 tests passed
• uv run --with-requirements docs/requirements.txt mkdocs build -f docs/mkdocs.yml -d site
• focused broker suite - 24 tests passed
• three independent hostile reviews - no remaining P1 or P2 findings

Real Obsidian runtime verification was not performed because this is dark infrastructure with no plugin lifecycle or user-facing wiring yet.

Release impact

No release is expected. This is a Conventional Commit refactor that establishes the next internal migration boundary without changing current behavior.

[cloudflare-workers-and-pages]

Deploying podnotes with    Cloudflare Pages

Latest commit:	be76760
Status:	✅  Deploy successful!
Preview URL:	https://40e8ecd6.podnotes.pages.dev
Branch Preview URL:	https://refactor-feed-capability-bro.podnotes.pages.dev

View logs