fix(policies): bind the capability picker to the array parameters

[pyramation]

Summary

#18 renamed the widget but not the parameter it writes to. The published node-type-registry (1.15.0) changed the authz nodes' shape:

-permission:   string     // one capability
+capabilities: string[]   // capability names, merged into one mask
+levels:       string[]   // trust-ladder level names, merged into the same mask

POLICY_PROVISIONING_CONFIG and POLICY_TYPE_UI_CONFIG both still keyed their override on permission, on AuthzEntityMembership, AuthzAppMembership and AuthzRelatedEntityMembership. Net effect: the capability picker wrote a parameter the platform no longer accepts, while capabilities / levels fell through to the generic multi-value editor, so an operator typed capability names by hand. paramOf(...)?.permission?.description was undefined for the same reason.

Each of those three overrides becomes two, and capability-select becomes multi-valued (MultiSelect) with a level-select sibling:

capabilities: { type: 'string[]', component: 'capability-select', label: 'Required Capabilities' },
levels:       { type: 'string[]', component: 'level-select',      label: 'Required Levels' },

Both are backed by one useCapabilities() catalog, split on kind — which this PR also starts selecting, since the schema-builder copy of the hook never asked for it:

kind === 'level' ? /* level-select */ : /* capability-select */

That split is the point: trust-ladder levels share the capability bitstring but are not operator-grantable, so a level appearing in the capability picker (as it did before the rename exposed kind) let an operator gate an RLS policy on an achievement. Now a level is selectable only as a level.

pnpm check passes. Needs a @constructive-io/data + @constructive-io/schema-builder publish before dashboard can mirror it.

Link to Devin session: https://app.devin.ai/sessions/8f89acc9280e4cef880921d966e0e8fc
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring