2336b98a36
Rework caps.sh to detect new capabilities rather than requiring an exact match, so the baseline works across Go versions. Add a forbidden capabilities list (UNSAFE_POINTER, NETWORK, CGO, EXEC) that will always fail the check. Use Go 1.26 and capslock@latest in CI. https://claude.ai/code/session_01HwDXpKevFLhE5EfrR6JrBn