Give --check stand-in nodes the real node type's capabilities

[bgrewell]

Stacked on #98.

The problem

--check substituted a single mock for every declared node, and that mock's capability set matched no real node type — it was wrong in both directions:

• It implemented Rebooter, so a suite rebooting a docker node validated clean and failed only on a real run, after the containers had been created.
• It did not implement Snapshotter, so every suite containing a snapshot step was rejected outright — including on lxd, where the step is perfectly valid. That made --check unusable for any suite using snapshots.

The fix

Capabilities now live in one table in nodetypes, consulted by both the stand-in nodes and the supported: ... half of the construction-time error messages. NewCheckNode(nodeType) returns a stand-in implementing exactly what that type really implements.

Before / after, same two suites:

### snapshot on an lxd node — was wrongly REJECTED
Configuration valid.

### reboot on a docker node — was wrongly ACCEPTED
Error: node "web" does not support reboot (supported: lxd, lxd-vm, ssh) in step "restart it"

Note the message now includes lxd-vm, which the hardcoded (supported: lxd, ssh) strings had omitted — a third, smaller inaccuracy the table fixes by construction.

Drift guard

The table caused this bug by being implicit, so the replacement is tested rather than trusted. TestCapabilityTableMatchesNodeTypes compares the table against what each node type actually implements — using zero-value pointers, so interfaces are checked without constructing anything or touching a daemon — and fails if any type the factory accepts is missing from the test. TestCheckNodeMirrorsRealCapabilities asserts each stand-in matches its type.

A node type that gains or loses a capability without updating the table now fails the build rather than silently putting --check back out of step.

Verification

• Both defect suites behave correctly, shown above.
• Every standalone example suite still passes --check.
• go build, go vet, gofmt, and the full test suite are green; the docs site builds.
• Docs updated: the two Notes describing these limitations are gone, and the --check sections in the README, cli.md, and steps.md now describe what it actually does.