Add cfctl operation contract matrix

[rogu3bear]

Summary

• Generate a repo-wide cfctl operation contract matrix from catalog/surfaces.json and catalog/runtime.json.
• Show read/can/apply/verify/desired-state support, preview gates, destructive confirmations, lane policy, selectors, and read-only surfaces in docs/capabilities.md.
• Add static contract assertions and operator-doc links so future agents use the matrix before falling back to backend scripts.

Test plan

• python3 scripts/render_capabilities_doc.py --check docs/capabilities.md
• PYTHONPYCACHEPREFIX=/tmp/cfctl-pycache python3 -m py_compile scripts/render_capabilities_doc.py
• git diff --check main...HEAD
• ./scripts/verify_static_contract.sh
• ./cfctl doctor --repair-hints