feat(input): highlight capability authorization keywords

[tt-a1i]

Summary

• make subagent and workflow explicit-mode authorization keywords
• share one classifier between pre-submit TUI feedback and runtime capability loading
• render recognized keywords in Claude Code-style lavender with a contrast-safe light-theme variant
• preserve negated/conditional fail-closed behavior and keep Suggestion ghost text inert

Validation

• bun run check
• Node tests: 811/811
• Vitest: 30/30
• Impeccable detector: 0 findings
• npm pack --dry-run --ignore-scripts
• real Pi TUI: subagent, workflow rendered both keywords as ANSI-256 color 183
• pi list: single OpenPI source points to this checkout

Closes #82