fix(api): make capability signatures invocation-only

[jmgilman]

Summary

• end generated capability signatures after their keyword-only parameter lists
• keep host Go output type identifiers out of catalog and MCP discovery surfaces
• document Description.Output / describe_api.output as the stable result contract
• cover exported and unexported output types through binding, catalog, structured MCP, and text-mirror regressions

Client migration

This intentionally changes the visible signature string. Clients that parsed a trailing -> <GoType> suffix must stop parsing it and use Description.Output or describe_api.output instead. No compatibility suffix or alternate field is retained.

Verification

• mise exec -- go test ./internal/binding -run '^TestSignature' -count=1
• focused catalog signature-surface tests
• focused MCP secure-loop and adapter tests
• external Go 1.26.6 smoke consumer registered exported and unexported outputs and observed only records.lookup(*, key: str) / health.status() plus stable output field shapes
• mise exec -- moon run root:check
• LSP diagnostics on binding, catalog, and MCP packages