feat(webui): sanctioned restart and graceful reload controls (Closes #642)

Adds a gated `system.restart_namespace` action so operators and workers can
restart or gracefully reload MCP namespaces through an authorized, audited
path instead of manual host process killing (#630).

- webui/sanctioned_restart.py: restart/reload operation model, dry-run
  intent preview, confirmation-string enforcement, audit emission, and
  post-restart health verification. Fails closed on unknown auth, missing
  capability, or ambiguous target namespace.
- webui/console_authz.py: RBAC entries for the restart capability with
  secret redaction preserved.
- webui/gated_actions.py: registers the restart action in the gated action
  framework so it cannot be invoked without capability + confirmation.
- task_capability_map.py: capability mapping for the restart operation.
- docs/sanctioned-restart-controls.md: operator documentation for the
  sanctioned path and the explicit prohibition on pkill recovery.
- docs/webui-authz-audit.md: audit model updated for restart events.
- tests/test_webui_sanctioned_restart.py: authorized preview, unauthorized
  deny, confirmation enforcement, contamination classification, and audit
  emission coverage.

No unrestricted kill path is exposed; manual pkill remains classified as
contamination and continues to block clean claims.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

task_capability_map.py

@@ -335,6 +335,21 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "role": "controller",
     },
 
+    # #642: sanctioned host-daemon lifecycle controls. Deliberately *not* a
+    # ``gitea.*`` operation — restarting an MCP namespace is a host action, not
+    # a Gitea API call, and no configured Gitea profile should be able to
+    # satisfy it by accident. Authority comes from the console RBAC model plus
+    # out-of-band operator authorization (#630); these entries exist so the
+    # console cannot invent an authority the capability layer never declared.
+    "restart_namespace": {
+        "permission": "runtime.restart_namespace",
+        "role": "controller",
+    },
+    "reload_namespace": {
+        "permission": "runtime.reload_namespace",
+        "role": "controller",
+    },
+
     # #601 first-class lease lifecycle — inspect/list need read; mutations gate on
     # ownership in the control-plane DB (not a separate Gitea write permission).
     "list_workflow_leases": {