refactor(capabilities): inline datamodel structs into parent packages (#21)

Each capability exposed its wire structs through a parent-package alias
to a `<cap>/datamodel/` subpackage:

    // capabilities/blob/add.go
    type AddArguments = bdm.AddArgumentsModel

The split solved a real problem: `bindcap.Arguments` requires CBOR codec
methods, those methods are what `cbor-gen` produces, and the parent
package couldn't compile against itself before codegen ran. Putting the
wire structs in a separate package broke that bootstrap cleanly.

The indirection has accumulated costs worth addressing now:

- The aliases are pure renames (Foo = otherpkg.FooModel), which we've
been trying to avoid elsewhere in the codebase.

- The `Model` suffix leaks back through struct field declarations.
`args.Metadata` reads as `Metadata` at the call site, but hover-types
and error messages still surface `MetadataModel` because the field is
declared with the suffixed name. A recent piri refactor surfaced a
confusing type mismatch where the alias chain took a while to untangle.

- Each capability duplicates the same `datamodel/` boilerplate (a `gen/`
subfolder, generator entry point, generated codecs).

This change inlines each `<cap>/datamodel/` into its parent and drops
the rename aliases. The codegen bootstrap is preserved with a build tag:
binding files carry `//go:build !codegen` and the generator runs with
`-tags codegen`, so during codegen only the wire types compile (no
bindcap dependency). The generator post-processes its output to
re-inject the tag, keeping subsequent runs stale-safe.

The top-level `capabilities/datamodel.UnitModel` becomes
`capabilities.Unit`. Per-op `OK` aliases that resolved to `UnitModel`
are kept as within-package aliases (e.g. `type AddOK =
capabilities.Unit`) to preserve operation-named labels at type-parameter
call sites like `bindexec.Response[*blob.AddOK]`.

Additionally, `capabilities.MustNew` wraps `bindcap.New` and panics on
construction error. The previous `var Foo, _ = bindcap.New(...)` pattern
silently dropped errors that, for hardcoded commands and options, can
only ever be programmer bugs — failing at package init is strictly safer
than discovering it later via nil dereference.

External impact: only the sprue repo imports an inner datamodel package
directly (two test files using
`access/datamodel.CapabilityRequestModel`). Those need to update
alongside the libforge bump — change the import path and drop the
`Model` suffix.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: frrist

capabilities/access/datamodel/cbor_gen.go capabilities/access/cbor_gen.gocapabilities/access/datamodel/cbor_gen.go renamed to capabilities/access/cbor_gen.go

@@ -1,18 +1,13 @@
-package access
+//go:build !codegen
 
-import (
-	adm "github.com/fil-forge/libforge/capabilities/access/datamodel"
-	cdm "github.com/fil-forge/libforge/capabilities/datamodel"
-	"github.com/fil-forge/ucantone/validator/bindcap"
-)
+package access
 
-type (
-	ClaimArguments = cdm.UnitModel
-	ClaimOK        = adm.ClaimOKModel
-)
+import "github.com/fil-forge/libforge/capabilities"
 
 const ClaimCommand = "/access/claim"
 
+type ClaimArguments = capabilities.Unit
+
 // Claim can be invoked by an agent to claim a set of delegations from the
 // account.
-var Claim, _ = bindcap.New[*ClaimArguments](ClaimCommand)
+var Claim = capabilities.MustNew[*ClaimArguments](ClaimCommand)

capabilities/access/claim.go

@@ -1,15 +1,15 @@
+//go:build !codegen
+
 package access
 
 import (
-	adm "github.com/fil-forge/libforge/capabilities/access/datamodel"
+	"github.com/fil-forge/libforge/capabilities"
 	"github.com/fil-forge/ucantone/errors"
-	"github.com/fil-forge/ucantone/validator/bindcap"
 )
 
-type (
-	ConfirmArguments = adm.ConfirmArgumentsModel
-	ConfirmOK        = adm.ConfirmOKModel
-)
+// ConfirmOK mirrors ClaimOK — confirming an access request grants the same
+// shape of delegations bundle as claiming them.
+type ConfirmOK = ClaimOK
 
 // ConfirmMetaKey is the key in metadata in any delegation created by a
 // successful access request. The value is a link back to the `/access/confirm`
@@ -19,7 +19,7 @@ const ConfirmMetaKey = "accessConfirm"
 const ConfirmCommand = "/access/confirm"
 
 // Confirm can be invoked by an agent to confirm an access request.
-var Confirm, _ = bindcap.New[*ConfirmArguments](ConfirmCommand)
+var Confirm = capabilities.MustNew[*ConfirmArguments](ConfirmCommand)
 
 const (
 	InvalidAccessConfirmSubjectErrorName = "InvalidAccessConfirmSubject"