Capability sandbox and fetch/WebSocket network bridge

[keys-i]

Deny-by-default capability object gating fs/net/clock/random. Honest browser networking via capability-gated fetch and WebSocket (no raw sockets). Network syscalls bridge here when granted.