chore(#1055): address argus review nits

- rename cap-cap-col → cap-col; add CSS rules for .cap-col and .cap-save-col
- drop zero-width-space replace in capability header cells (nowrap makes it a no-op)
- add Capability::ALL to hive-sh4re; validate incoming cap strings in post_capabilities

hive-sh4re/src/lib.rs

@@ -923,6 +923,14 @@ pub enum Capability {
 }
 
 impl Capability {
+    /// Every known capability in a stable order. Use this to enumerate
+    /// columns in the permissions UI or validate incoming capability strings.
+    pub const ALL: &'static [Self] = &[
+        Self::ManageRootAgent,
+        Self::ReadHostJournal,
+        Self::QueryAgentState,
+    ];
+
     /// Canonical `snake_case` name for this capability (matches serde).
     #[must_use]
     pub fn as_str(self) -> &'static str {