Wire capabilities descriptor for protocol-level callers.

Unauthenticated. A protocol-level caller (e.g. a control-plane service) GETs this at startup to negotiate the core feature surface WITHOUT the JS SDK. Mirrors the SDK providers capabilities() descriptor over the wire. Like /health`, it advertises a static capability surface (no user data), so it waives the document-level bearer requirement.