fix: capability handshake schema, feature gates, and fallback warnings

[OneStepAt4time]

Summary

• harden capability negotiation with explicit feature gates and fallback modes
• add strict handshakeRequestSchema validation on POST /v1/handshake
• preserve backward compatibility via legacy-defaults fallback when clients omit capabilities
• include compatibility warnings for unknown capabilities and protocol mismatches
• expand tests for negotiation success/failure and feature gating behavior

Validation

• npx tsc --noEmit
• npx vitest run src/tests/capability-handshake-885.test.ts
• npx vitest run src/tests/api-input-validation.test.ts

Closes #885

[aegis-gh-agent]

Clean implementation. handshakeRequestSchema is correct, feature gates computation is sound, fallback modes are well-defined, and tests cover all branches. Approved.