Refactor provider contracts to capability-based contracts + require capability advertisement

[blindzero]

#Summary

Providers must explicitly advertise supported capability IDs (string list).
Capability list MUST NOT be empty; missing/empty => validation failure.
Split provider contract tests into per-capability suites (Core capabilities only).

Define Core capability IDs:

• Identity:
  • IdLE.Identity.Read
  • IdLE.Identity.List
  • IdLE.Identity.EnsureAttribute
  • IdLE.Identity.Disable
  • IdLE.Identity.Enable
• Entitlement:
  • IdLE.Entitlement.List
  • IdLE.Entitlement.Grant
  • IdLE.Entitlement.Revoke

Add plan/validation rule: if a workflow/step requires a capability that is not advertised => fail fast with clear message.

Acceptance Criteria:

• A provider exposes metadata including Capabilities (non-empty string array).
• Contract tests exist per core capability and only apply when provider advertises that capability.
• Plan validation fails deterministically if required capability missing.
• Existing Mock provider updated to advertise its capabilities.

Tests updated/added accordingly.